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SUMMARY 


The Seasat spacecraft failed on October 9, 1978, after satisfactory operation in orbit for 105 
days, as a result of a loss of electrical power in the Agena bus that was used as a part of the space- 
craft. This loss of power was caused by a massive and progressive short in one of the slip ring 
assemblies that was used to coimect the rotating solar arrays into the power subsystem. The most 
likely cause of this short was the initiation of an arc between adjacent slip ring brush assemblies. 
The triggering mechanism of this arc could have been either a wire-to-brush assembly contact, a 
brush-to-brush contact, or a momentary short caused by a contaminant that bridged internal 
components of opposite electrical polarity. 

The slip ring assembly, as used in the Seasat spacecraft, was connected into the power subsystem 
in such a way that most of the adjacent brush assemblies were of opposite electrical polarity. This 
wiring arrangement, together with the congested nature of the design itself, made the Seasat slip 
ring assembly a unique, first-of-a-kind component that was particularly prone to shorting. 

The possibility of slip ring failures resulting from placing opposite electrical polarities on adjacent 
brush assemblies was known at least as early -as the summer of 1977 to other projects within the 
contractor’s organization. Furthermore, failures of slip ring assemblies due to shorting between 
brushes had been experienced by the prime contractor on slip ring assemblies used by other pro- 
grams. That the Seasat organization was not fully aware of these potential failure modes was due to 
a breakdown in communication within the contractor’s organization. 

In addition to this small, though fatal, breakdown in communications, the failure to give the slip 
ring assembly the attention it deserved was due, in large part, to an underlying program policy and a 
pervasive view that Seasat’s Agena bus was a standard, well proven piece of equipment that had 
been used on other programs. In actuality, however, three major subsystems— the electrical power 
subsystem, the attitude control subsystem, and the data subsystem— were substantially modified for 
use on Seasat’s Agena bus. So firmly rooted was this principle of using a “standard Agena bus” that^ 
even after the engineering staffs of both the government and the contractor were well aware of the 
final uniqueness of their bus, the words, and the associated way of doing business, persisted to the 
end. 

The point of view that the Seasat bus was flight proven, standard equipment proved to have far- 
reaching consequences. It became program policy to minimize testing and documentation, to qualify 
components by similarity wherever possible, and to minimize the penetration into the Agena bus by 
the government. It led to a concentration by project management on the sensors, sensor integration, 
and the data management system to the near exclusion of the bus subsystems. Important compo- 
nent failures were not reported to project management, a test was waived without proper approval, 
and comphance with specifications was weak. The component that failed— the slip ring assembly— 
was never mentioned in the briefing charts for either the Consent to Ship meeting or the Critical 
Design Review. 
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The Failure Modes, Effects, and Criticality Analysis that was conducted for the electrical power 
subsystem did not consider shorts as a failure mode and thus did not reveal the presence of single 
point failure modes in the system nor provide a basis for the development of a full complement of 
saflng command sequences that could be used by the flight controllers in responding to anomalies 
in the power subsystem. A lack of clarity and rigor in the operating requirements and constraints 
documents for the power subsystem of the bus, together with this lack of sating command sequences, 
prevented the flight controllers from having all the tools they needed to do their job. The flight 
controller for the power subsystem was also new to his job at the time of the failure and thus was 
not sufficiently knowledgeable of the system he was controlling. While no action of the flight 
controllers contributed to the failure, they did fail to follow the prescribed procedures in response 
to the information available to them at the time of the failure. 

The advantages of using standard, well proven equipment in terms of both cost and mission suc- 
cess are well recognized. But the experience of Seasat illustrates the risks that are associated with 
the use of equipment that is classified as “standard” or “flight proven,” The uncritical acceptance 
of such classifications by the Seasat engineering staff submerged important differences in both 
design and application from previously used equipment. It is therefore important that thorough 
planning be conducted at the start of a project to fully evaluate the heritage of previously used 
equipment and to establish project plans and procedures that enable the system to be selectively 
penetrated. 
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I - INTRODUCTION 


On October 9, 1978, the Seasat spacecraft fahed some 105 days after launch into orbit. To iden- 
tify the nature of this failure, and to determine the underlying causes that led to its occurrence, the 
Deputy Administrator of NASA established a Seasat Mission Failure Investigation Board on Octo- 
ber 16, 1978. A copy of the Board’s Charter, of the letter of authorization to the Chairman and of 
the membership of the Board is presented in the Appendix of this report. 

The Board initiated its investigation on October 23, 1978. The identification of the failure mode 
was accomplished through an analysis of available flight data and examination of the build history, 
test results and qualification reports on the relevant spacecraft subsystems and components. Mate- 
rial assistance was provided to the Board in this task by the engineering staffs of both the Jet 
Propulsion Laboratory (JPL), the responsible NASA installation, and the Lockheed Missiles and 
Space Co., Inc. (LMSC), the principal industrial contractor. Some valuable research that had been 
conducted by both LMSC and by the Sperry Flight Systems Co. also contributed to this failure 
analysis. 

To determine the underlying causes of the failure, the Board examined all relevant documentation 
related to the history of the Seasat program and conducted extensive discussions with the staff and 
management of LMSC and JPL. 

These investigations permitted an identification of a most likely failure mode and some of the 
principal technical and management actions that led to its occurrence. This report presents the re- 
sults of the Board’s investigation in response to the charge of its Charter. 
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II - THE SEASAT MISSION AND ITS SPACECRAFT 


The Seasat Project was a proof-of-concept mission whose objectives included demonstration of 
techniques for global monitoring of oceanographic and surface meteorological phenomena and 
features, provision of oceanographic data for both application and scientific areas, and the deter- 
mination of key features of an operational ocean dynamics monitoring system. 

To fulfill these objectives, the Seasat sensor complement comprised a radar altimeter (ALT), a 
Synthetic Aperture Radar (SAR), a Seasat-A Scatterometer System (SASS), a Scanning Multichannel 
Microwave Radiometer (SMMR), and a Visual and Infrared Radiometer (VIRR). All of these 
sensors except the SAR operated continuously; telemetry from them, as well as from all engineering 
subsystems, was sent in real-time when over a ground station and recorded on a tape recorder for 
later transmission to provide data for a full orbit. SAR data had to be transmitted in real-time, with- 
out the use of the onboard recorder, to specially equipped stations because of its high data rate. The 
. normal duty cycle for the SAR was 4 percent. 

The five sensors were integrated into a sensor module that provided mounting, thermal control, 
power conditioning, telemetry, and command support to the instruments. The second major element 
of the spacecraft was an Agena bus which provided attitude control, electrical power, telemetry and 
command functions to the sensor module. In addition to these on-orbit functions, the Agena bus 
also provided injection stage propulsion and guidance to orbit. The spacecraft was 3-axis stabilized 
with aU sensors earth pointing and is shown in its on-orbit configuration in Figure 2-1. To provide 
near global coverage, the spacecraft was injected into a 790 kilometer, near circular orbit with an 
inclination of 108 degrees and a period of approximately 101 minutes. Design Ufetime was one year 
on orbit, with expendables provided for a three year life. 

The sensors were provided by various NASA Centers. The sensor module, the Agena bus and the 
integration of the sensors, sensor module and Agena bus into a spacecraft was provided by LMSC 
under contract to JPL. 

Responsibility for Seasat project management, mission planning and direction, mission operations 
and experiment data processing resided at JPL. The Goddard Space Flight Center (GSFC) provided 
network support and spacecraft orbit and attitude determinations; use was therefore made of the 
existing Spaceflight Tracking and Data Network (STDN), the NASA Communications (NASCOM) 
network, and the Project Operations Control Center (POCC) that are operated by GSFC. 

To place this failure review in a proper perspective, it is noted that the Seasat spacecraft operated 
in orbit in a generally satisfactory maneuver for over 3 months and provided a large amount of 
scientific data. The sensors represented a significant advance in technology and their integration 
into the sensor module, a large engineering challenge. In addition, Seasat also required the creation 
of significantly enlarged capabilities in the acquisition and processing of flight data. That the impor- 
tant and significant technical and engineering advancements were achieved is a tribute to the skill 
and dedication of all who were associated with this program. 
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The Seasat spacecraft was successfully launched on June 26, 1978, and thus operated for 105 
days until the failure occurred on October 9, 1978. During this time in orbit, the spacecraft opera- 
tion was generally satisfactory with considerable data being obtained from all of the sensors. Three 
significant anomalies were experienced during the life of Seasat in orbit, one involving sun interfer- 
ence in the attitude control system scan wheels, one caused by a sticking thermostat in a sensor 
heater circuit, and one in which the spacecraft suffered an abnormally low bus voltage for several 
orbits. Because of a possible relationship of these latter two anomalies with the failure of October 9, 
1978, they were specifically investigated by the Board and are discussed herein. 
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m - THE FAILURE 


The first indication of a spacecraft failure available to the flight controllers occurred when the 
Santiago STDN station (AGO) acquired the spacecraft on Rev 1503 at approximately 03:30 GMT 
on October 10, 1978 (U:30 PM EDT, October 9, 1978 at GSFC). At that time, indications of 
abnormal battery currents, battery voltages, solar array temperatures and unregulated bus voltage 
were noted. Approximately 13 minutes later, at 03:43 GMT, loss of signal (LOS) occurred at AGO, 
Because these data were not completely understood at the time, the next STDN station at Orroral 
(ORR) was called up to receive additional data. Thus, an additional 9 minutes of flight data starting 
some 17 minutes after LOS at AGO were obtained. The last communication from the spacecraft 
occurred at LOS ORR about 04:08 GMT; all subsequent efforts to make contact with the space- 
craft were unsuccessful. 

On October 11, 1978, JPL project management was advised by personnel at the European Space 
Agency Oak Hanger Tracking Station at Famborough, England (UKO), that they had obtained 
flight data from the spacecraft during its pass over their station. Although not a part of the opera- 
tional Seasat network, this station routinely received data from the Seasat spacecraft for their own 
purposes. This UKO data on Rev 1503 covered the period from 03:00 GMT to loss of effective data 
stream at about 03:13 GMT and was made available at JPL for failure analysis on October 12, 1978. 
As it turned out, this UKO data contained the event of the failure and identified the time of the 
failure at 03:12:02 GMT, some 6 minutes after the spacecraft entered an eclipse and about 1 min- 
ute before the loss of data. A ground track of the flight path of the spacecraft on Rev 1503 over 
these three stations of interest is presented in Figure 3-1. 

Post-event flight data available for failure analysis thus comprised approximately 1 minute of data 
from UKO, 13 minutes of data from AGO, and 9 minutes of data from ORR. Obviously, the most 
valuable data for purposes of identifying the failure mode was the 1 minute of data between the 
initial event of the failure and loss of data from UKO. 

Subsequent examination of these data revealed that a massive and rapidly progressive failure 
occurred in the electrical power subsystem. Accordingly, the identification of the most likely failure 
mode involved, in addition to the analysis of the flight data, an analysis of the thermal behavior of 
the spacecraft, an examination of all of the build paper, qualification status reports, test history, as- 
built drawings and photographs, discrepancy reports, related failure reports and other documenta- 
tion related to the various components, wiring, assembly and checkout of the electrical power 
subsystem. Taken altogether, this information was sufficient to identify a most likely failure mode 
without the necessity of any post event failure mode testing. 
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Figure 3-1. Ground Trace of Seasat Revolution 1503 
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IV - PROGRAM HISTORY AND MANAGEMENT 


Environment 

The Seasat program was conceived and initiated in a period of transition in the philosophy of 
management of NASA programs following the Apollo program. Apollo, and to varying degrees 
other NASA flight programs, were characterized by extensive test programs, large formal docu- 
mentation systems, and comprehensive and frequent technical and management reviews. A large 
in-house staff was required in order to implement this approach. The high cost of conducting 
space programs in this mode severely constrained the future uses of space. During the final phases 
of the Apollo program, NASA management accordingly instituted a policy aimed at reducing the 
cost of carrying out space missions. This policy was aggressively pursued by the highest levels of 
management. 

A Low Cost Systems Office was established in Headquarters to oversee a standardization pro- 
gram and to encourage the use of existing hardware. This program included the development of 
“standard” components as well as a multimission spacecraft. 

A major emphasis was placed on shifting work from “in-house” to “out-of-house” in consid- 
eration of reducing the NASA manpower base. Design-to-cost techniques and cost benefits of 
heritage through the use of hardware and software developed for other programs were subjects 
to be addressed at each step in the approval cycle. 

Management Philosophy 

The basic philosophy of the'Seasat program was thus established in an environment in which 
management emphasis was shifting from one of demonstrating a national capability to operate 
reliably in space to one of reducing the cost of utilizing space. Design-to-cost was a fundamental 
tenet of the Seasat project definition. A cost estimate of $58.2 million was established as a tar- 
get cost at the end of the feasibility study phase in mid-1973 and was imposed as a design-to-cost 
ceiling in December 1973 by NASA management. Any overruns were to be offset by descoping 
the mission content. 

In attempting to define a program which would both satisfy the user community and live 
within the ceiling cost, the concept of making maximum use of proven existing hardware and 
software was adopted early in the program planning phase. This in turn provided for a reduction 
in design and development effort and in the size of the in-house staff needed to monitor the 
activity. 

These were key elements of the management philosophy which influenced the structure and 
conduct of the program. 
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Progratn Planning 


Feasibility Studies (Phase A) — Feasibility for the Seasat mission was established in 1973 
through three studies conducted by the JPL, GSFC, and the Applied Physics Laboratory (APL) 
of the Johns Hopkins University. TTiese studies were aimed at meeting the set of user require- 
ments generated at a series of meetings held in the first half of 1973 among NASA and repre- 
sentatives of the governmental, commercial, and institutional communities of users of ocean 
dynamics data. With the user requirements as a basis, the feasibility studies examined the Seasat 
mission from an overall systems viewpoint, including a review of instrumentation and possible 
spacecraft (bus) approaches to accommodate the instrumentation. 

Subsequent to the submission of the Phase A studies in July 1973, a joint NASA/User Study 
Task Team was formed to review the Phase A studies, integrate the results, and provide technical 
and programmatic guidance for more in-depth Definition Phase studies. 

As a result of this review, the Task Team recommended a Baseline Mission which included a 
complement of the five sensor types that actually ended up flying on Seasat. 

Based upon cost estimates prepared by the Phase A study participants, the Task Team recom- 
mended a target cost of $58.2 milUon for the Baseline Mission. This included the cost of the 
spacecraft bus and instruments, the launch vehicle, and tracking and data acquisition. An Alter- 
nate Payload Mission of reduced capability, excluding the synthetic aperture radar, was also rec- 
ommended for further study with a target cost of S43.2 million. 

There was some discussion in the Seasat Study Task Team Report (October 1973) of the use of 
an existing bus to minimize cost. The idea, however, was addressed with some skepticism. While it 
was believed that the use of subsystems with a high degree of inheritance from existing programs 
was desirable and possible, it was not clear at that time that an existing bus could be adapted 
economically. 

Definition Studies and Preliminary Design (Phase B) — Definition Phase Studies of the Baseline 
and Alternate Payload Missions recommended by the Seasat Study Task Team w^ere conducted 
from November 1973 to the summer of 1974. Wallops Flight Center (WFC) managed the Defi- 
nition Phase Study of the Baseline Mission which was conducted by APL. The JPL, assisted by 
various aerospace companies familiar with earth satellite design, conducted the Definition Phase 
Study of the Alternate Mission. 

In December 1973, NASA management adopted the $58.2 million figure recommended by the 
Task Team as a not to exceed ceiling for the Seasat Baseline Mission. The efforts of the Definition 
Phase Study participants were accordingly intensified to develop the most economical satellite 
system possible that would best suit the user requirements within the cost ceiling. 

The GSFC declined to participate in the Definition Phase activity as the.y had serious doubts as 
to their ability to structure a full Baseline Mission within the design-to-cost ceiling. 

With the stimulus of the design-to-cost ceiling, and management emphasis on the maximum use 
of existing subsystem hardware, the JPL Definition Phase Group proposed the idea of building a 
spacecraft system comprising two major elements: a sensor module designed specifically for Sea- 
sat, and a spacecraft bus based on an existing, flight proven bus developed for other Air Force or 
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NASA programs. The JPL viewed the results of the Phase A studies as indicating that the require- 
ments of the sensors could be satisfied by standard support subsystems for attitude control, 
power, structures, thermal control, etc. On the other hand, the area of largest uncertainty was 
seen to be the definition of the sensor’s operating capabilities, data requirements, and sensor 
system integration. It was therefore proposed that if a suitable spacecraft bus were available, the 
design and development effort could be concentrated on the sensors and their integration with a 
sensor module that could then be mated to the bus through a mechanical-electrical interface. 

The JPL entered into four $ 1 5,000 study contracts with aerospace companies (Boeing, General 
Electric, Lockheed, and TRW) that had existing spacecraft designs with capabilities in the range 
of Seasat requirements to evaluate the concepts that: (1) Uiere are existing buses that could be 
used, without modification, to supply the necessary support functions for the sensor payload, 
and (2) new-design functions could be incorporated in a separate module along with the sensors 
and thereby reduce the systems development task to a sensor system development task. The 
studies were conducted from November 15, 1973, to March 30, 1974. The sensors were described 
to the study contractors as they were developed on December 15, 1973, with updates as appro- 
priate until the end of these studies. 

It was concluded as a result of these studies that basic sensor support requirements could be 
satisfied by the existing spacecraft bus designs studied with “no major changes,” although “minor 
modifications” were acknowledged to be required. It was contemplated, for example, that minor 
modifications would be required of the attitude control, power, and temperature control sub- 
systems. Telemetry, tracking and command subsystems were reported to be “off-the-sheir’ 
designs, but required significant modification. It should be noted that the contractor bus studies 
were concerned almost solely 'with mission perfoimance requirements. The reports did not suf- 
ficiently define the subsystem design or component selections to provide a basis for an adequate 
penetration of heritage. The JPL Definition Phase Final Report nevertheless concluded that the 
existing bus approach had significant cost, schedule and risk advantages, and permitted a concen- 
tration of development efforts on the sensor system. 

Mid-term reports in May 1974 of the JPL and WFC/APL Definition Phase study groups demon- 
strated that neither the Baseline nor Alternate Payload Mission was achievable within the $58.2 
million ceiling. WFC/APL’s estimate for the Baseline Mission, which included an in-house designed 
spacecraft, was $85.2 million. At this point in time WFC/APL adopted the sensor module/existing 
bus concept that JPL was pursuing. JPL’s mid-term estimate for the Alternate Payload Mission 
using the existing bus concept was $65.9 million. 

Both JPL and WFC/APL searched for ways to descope the project in order to stay within the 
cost ceiling. Each group performed a number of iterations wherein sensor performance and sensor 
combinations were varied in order to decrease the cost and yet meet the basic user requirements. 

A final presentation of the JPL and WFC/APL Definition Phase studies to.NASA Headquarters 
management in August 1974 resulted in a reduced baseline payload at the $58.2 million ceiling 
which eliminated the microwave radiometer and combined the altimeter and scatterometer into 
a single instrument, but which retained the synthetic aperture radar, as well as the visual and infra- 
red radiometer. 
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Program Imptementation 
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In the summer of 1974, at the completion of the Definition Studies, the concept of using an 
existing spacecraft bus was firmly established. An analysis by the Program Manager stated that: 

“The most important Seasat-A Program objective is: To place most of the program money 
on the project peculiar sensors and direct sensor support subsystems. To accomplish this, 
the selection of an exisiting Low Cost spacecraft bus supplying power, structure, attitude 
control, orbit adjust, etc., is essential; and selection of the specific existing spacecraft to be 
used for Seasat-A must necessarily be made early in the program so that sensor and sensor 
support subsystems design and integration planning can take advantage— Low Cost— of the 
peculiar attributes of the specific existing spacecraft.” 

The program had been submitted to the Congress in January 1974 for approval as an FY 1975 
“new start,” with a run-out cost of $58.2 million. Congressional action was completed in Septem- 
ber 1974. Responsibility for project implementation was not assigned to a NASA field installation 
at that time and thus no project office was established for another two months. 

Project Initiation — In November 1974, JPL agreed to accept the management of the Seasat 
Project at the $58.2 million ceiling with the reduced payload resulting from the Definition Phase 
descoping effort discussed above. The JPL acceptance was, however, made subject to a review in 
early 1975 of the project scope and user community reaction to it. (Letter from JPL Director to 
NASA Associate Administrator for Applications, November 7, 1974.) The above JPL letter further 
recognized the fiscal constraint of the $58.2 million ceiling by suggesting that the projected 
April 1 978 Seasat launch be “treated like a unique planetary opportunity ... in order to hold 
costs and . . . achieve the proper schedule/cost relationships.” On November 25, 1974, the 
Program Approval Document (PAD 61-600, Sub PAD No. 61-630-655) was signed, officially 
designating JPL as the Project Management Center to be assisted by WFC and APL. The sensor 
procurements were to be accomplished by designated NASA Centers and furnished to WFC/APL 
for integration with the Sensor Module. The Sensor Module was then to be supplied to JPL to be 
integrated with the bus. 

The Seasat Program represented a major departure from the predominant JPL experience base. 
It was the first applications mission for which JPL was responsible, the only earth-orbital mission 
since Rangers 1 and 2, the first mission in which operations were to be conducted at a location 
other than JPL, and only the third mission in which an out-of-house contractor was given the 
overall systems integration responsibility. 

The “existing bus” concept became an official requirement of the Seasat Project as the 
authorizing language in the PAD specified that “a(n) ‘existing’ bus be competitively acquired by 
JPL from industry with minimal modification.” The next sentence of the PAD specifies that the 
“ ‘standard’ bus module” be procured on a Fixed Price type Contract. The descriptions “standard 
bus module” and “existing bus” were apparently intended to be equivalent." 

The Seasat Project Office was formed in November 1974, with a staff comprised of nine people. 
The Financial Manager and Contract Negotiator were collocated with the Project, but were organi- 
zationally responsible to other Divisions and are not included in the nine. The Project Staff was 
also assisted by personnel from the JPL Technical Divisions which varied from 26 to 88 personnel 
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over the life of the Project. Out of the approximately 1 5 people involved in the JPL Definition 
Phase Study, only one was carried over into the Project Staff. Approximately five more people 
from the Definition Phase Study Group continued to give support to Seasat from the JPL Tech- 
nical Divisions. 

In negotiation of the staffing level by the Project Office with each of the JPL support divisions, 
it was made clear that the JPL role was one of monitoring the contractor’s activity and that 
maximum reliance was going to be placed on the use of existing contractor management systems 
and procedures. It was further made clear that technical monitoring would be based on limited 
penetration of subsystems with emphasis to be placed on the major interfaces. This is manifested 
in a JPL Interoffice memo (S-75-23) from the Seasat Project Manager to the JPL Technical Divi- 
sions supporting Seasat which states in part: 

“The spacecraft system is based on the use of an existing earth orbiting bus modified to meet 
mission unique requirements. It will be provided on a Fixed-Price-Incentive contract. With 
this base and without the need for technology transfer from JPL to the contractor, it is 
believed manpower levels required to manage and monitor the contractor are justifiably less 
than that necessary on past projects.” 

There was substantial desire on the part of all concerned to proceed with obligation of the 
funds that had become available in September 1974, although the Definition Phase Study left 
much to be desired. Preliminary design efforts were not only insufficient to generate meaningful 
component selections, schedules, cost estimates, test plans, qualification requirements, etc., which 
should be developed driiing a Phase B activity, but also were conducted with respect to a manage- 
ment structure and sensor complement that were significantly different from those ultimately 
implemented. 

During the first few months after the Project Office was formed, a primary concern of the 
Project Staff was to prepare and issue an RFP for the spacecraft bus and integration support. 
The RFP was issued on January 13, 1975. Sensor contracts were let about this time and during 
the next few months the sensors, sensor module and sensor interface became increasingly defined 
and cost estimates were updated. In addition, reaction of the user community to the reduced 
capability payload resulting from the design-to-cost constraints stimulated a reassessment of the 
Baseline Mission. In July 1975, it was decided to increase the baseline payload by adding back 
the microwave radiometer and a full performance altimeter. These and other program adjust- 
ments resulted in increasing the ceiling cost from $58.2 million to $74.5 million. This last figure 
was considered by both Project and Headquarters management as tight but achievable. 

At this time the functional organization of the project was also reassessed. It was decided that 
the WFC/APL role would be reduced to include supplying the full performance altimeter, imaging 
radar data link, and system engmeering support. The scope of the contract effort was increased to 
include not only the spacecraft bus, but also the sensor module and its intes-ation with the bus. 
The sensors being developed by the various NASA Centers were to be Government Furnished 
Equipment (GFE) to the contractor. This scope change to the contract effort necessitated a re- 
solicitation. The second RFP was issued on September 10, 1975. 

As with the first RFP, LMSC and General Electric were the only contractors that submitted 
proposals. On November 20, 1975, JPL selected LMSC with which to negotiate for the procure- 
ment of the Seasat Satellite System. 
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Th« following were among the LMSC proposal strengths identified in the selection process; 

(1) The flight experience of Agena as a spacecraft and launch vehicle was found to be very 
good. The experience was found to comprise over 300 flights the last of which were 98 
percent successful. The Agena was therefore found to be an extremely well proven, re- 
liable space vehicle. 

(2) Most of the proposed hardware at the assembly level was found to have previous flight 
experience in that it was identical to previous Agenas. 

(3) Fabrication and test of modified designs were found to be based on proven approaches. 

For the next few months the efforts of the JPL Project Staff and JPL Technical Support Divi- 
sions were primarily directed toward the fact finding and negotiation process in connection with 
LMSC’s proposal. The contracts between JPL and LMSC for the Seasat Satellite System were 
signed on February 12, 1976. A Fixed-Price-Incentive (FPI) contract called for LMSC to furnish 
an Agena bus appropriately modified to meet Seasat unique requirements. Under a Cost-Plus- 
Award-Fee (CPAF) contract LMSC was to provide the sensor module and system integration 
effort. 

As might be observed from the above, the pace of business in the Project Office was fast and 
hectic from the day it was initiated. In fact, the Project Office was, in the words of the Project 
Manager, in the position of “playing catch-up since day one.” To recapitulate the foregoing, the 
project had been approved by the Congress in September of 1974, prior to assignment of project 
responsibility to JPL. In early November 1974 JPL management had accepted the project assign- 
ment with a $58.2 million cost ceiling subject to a review in early 1975 of the project scope and 
to the user community reaction to it. The Project Office was accordingly established in November 
1974 with a minimum of infusion of personnel from the Definition Phase (Phase B) study team. 
It became a first order of business for the Project Office to issue an RFP for the bus and integra- 
tion contracts. An RFP was accordingly issued in January 1975 even though JPL was aware of 
several problems with the program as structured including the concerns of the user community 
with the proposed payload content. In the spring of 1975, two major perturbations resulted in 
increasing the sensor complement and reassigning the organizational responsibilities which neces- 
sitated the issuance of a new RFP. The program was redefined, recosted, and approved by Head- 
quarters in mid- 1975, and the new RFP issued in September. 

While the initiation of the program was delayed some 8 months as a result of this restructuring, 
the launch date was delayed only 6 weeks, thus compoimding an already difficult schedule. The 
restructuring also invalidated much of the already meager Phase B work. 

The major technical and management challenge of Seasat was to develop a set of advanced 
sensors, to integrate them successfully into a sensor module, and to create an expanded capability 
in data acquisition and processing within a tight schedule. The Project, therefore, proceeded at 
a fast pace, and at times under hectic conditions. There was little time to reflect, to explore 
alternative approaches to problems, and to thoroughly develop plans and procedures. That the 
Seasat sensors and the data system were apparently very successful is a tribute to the dedication 
and skill of the project staffs of both the government and the contractors. 
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Project Implementation — At the time of contract go-ahead, the sensor complement, the overall 
budget and the launch date were firmly established as was the use of an existing “flight proven” 
Agena bus to be procured under an FPI contract with minimal government involvement and 
monitoring. 

The principal technical and engineering challenges were viewed to be in the sensor develop- 
ment, systems integration and the development of a data handling system. The JPL in-house 
support had been sized for a limited penetration of the Agena bus and the personnel advised of 
this policy. 

The contracts with LMSG contained 1 5 deliverable data items which required JPL signature. 
These included specifications for the spacecraft bus, as well as plans for qualification, configura- 
tion control, reliability, systems test, operations, etc. For implementatioii of these plans, and 
consistent with Program policy, the Project Office was largely dependent on the contractor for 
configuration control, mass properties control, compliance of component' specifications with 
systems specifications, subcontractor compliance, and qualification certifications. The Project 
Office was solely dependent on the contractor for assurance that the flight and test history of 
similar components used on other programs was brought to the attention of the proper Seasat 
contractor personnel and acted upon. 

There is no indication that the JPL technical or management persoimel did not maintain free 
and open communications with their LMSC counterparts. To the contrary, they appeared in 
general to be weU aware of the status of the project on a timely basis to the extent of knowledge 
of their counterparts. Their efforts to selectively focus attention on the areas of hkely difficulty 
were hampered by the lack of a more thorough Phase B study which, among other things, should 
have explored the modifications required to the Agena bus in greater detail. 

Penetration into the bus was also inhibited as a result of the cost growth of the program. At the 
time the LMSC contracts were signed in February 1976, the ceiling cost for Seasat was budgeted 
at S74.5 million. As of June 30, 1978, the cost, including scope changes and overruns was pro- 
jected to be $94.0 minion. Major reasons for the escalation included significant scope changes to 
the CPAF contract for the sensor module and system engineering as weU as a $6.5 million (40%) 
overrun by LMSC on this contract. Another major item was an increase in the cost of the launch 
vehicle from $5 million to $12.6 million in order to accommodate weight growth and to avoid 
potential launch vehicle buffeting. 

As a result of this cost growth, there were frequent admonitions from the Headquarters Program 
Office during the course of the project to hold costs, including, among other things, suggestions 
to cut back or even eliminate JPL penetration of the Agena bus. The extent of infusion of this 
pressure on the project prompted JPL management to express a concern to NASA management in 
September 1977 regarding the proper balance between performance and cost goals. Although 
cost control was recognized as important, JPL was concerned that the , reaction of the Project 
Staff would result in an overemphasis of cost at the expense of hardwi re quality and adequacy. 
In point of fact, however, no evidence was revealed that would indicate the Project Staff ever 
consciously sacrificed hardware quality and adequacy for the sole sake of costs. Nevertheless, 
cost control was a constant concern resulting in an active and sometimes tension-filled dialogue 
between the JPL Project Office and Headquarters Program Office. The resulting ?tmosphere was 
less than conducive to optimum project management. 
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In tins same vein, a word must be said about the LMSC contract overruns. Both the FPI and the 
CPAF contracts incurred cost overruns. On the FPI contract, the overrun toiounted to approxi- 
mately $145,000 above the contract ceiling. LMSC accordingly earned no fee under this contract 
and absorbed the $145,000 as a loss. The CPAF contract to date is known to have an overrun of 
approximately $6,500,000, or 40 percent. Final figures may increase this slightly. Despite their 
poor profit position, no evidence was found of any instances where LMSC sacrificed technical 
performance solely to reduce costs. In particular, no connection could be found between the flight 
failure and the poor profit environment that resulted from either of these contracts. 

In retrospect, the environment that was created by holding so firmly to the concept -of using 
an existing bus produced a disarming level of confidence in the heritage of the Seasat Agena 
bus. The Project Staff, to be sure, was aware of the various design changes to the Agena bus that 
were made to accommodate Seasat unique requirements. In spite of this awareness, the concept of 
the existing or standard bus, as it became interchangeably referred to, was so far embedded in 
Program policy, that this awareness became submerged. Changes to the bus were not perceived 
significant enough to violate the principle of the Standard Agena Bus. The mindset was that to the 
extent subsystems were not identical, they all used previously flight proven components or com- 
ponents close enough to be qualified by similarity. As a result of this environment, JPL personnel 
were not sufficiently sensitized to exploring the differences between the existing standard Agena 
bus and the one used for Seasat. 

As it turned ' out, the Agena Bus finally used for Seasat carried a unique power subsystem, 
attitude control subsystem, and telemetry subsystem. As far as orbital functions are concerned, 
all that was really standard was the basic structural configuration and the primary propulsion 
system. 

For example, with regard to the power subsystem, the solar arrays were the first application 
of a rotating array on the aft end of the Agena, the slip ring assembly had no applicable flight 
experience, and the solar array drive electronics (SADE) had undergone extensive redesign. 

In spite of the significant differences in both design and application from prior experience, 
the basic concept of the standard, existing bus persisted. For example, the Pre-Launch Mission 
Operations Report (No. E-655-78-01) dated June 23, 1978, (three days prior to launch) described 
the Seasat Satellite System as comprising two major hardware elements: 

• “A standard support bus which is based on the Lockheed Missiles and Space Company 

(LMSC) Agena ” 

• “A sensor module . . . .” 

The Agena, the Report further notes, “has had over 3 00. flights and has previously achieved 
orbit operations of over two years.” 
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V-THE ELECTRICAL POWER SUBSYSTEM 


General Description 

The Electrical Power Subsystem (EPS) was designed to provide power at 28 ±4 VDC to the 
spacecraft subsystem and sensors using solar arrays and rechargeable batteries. Figure 5-1 is a block 
diagram of the power subsystem and Figure 5-2 shows the general location of the power subsystem 
on the spacecraft. A simplified schematic diagram of the EPS is presented in Figure 5-3. The basic 
design philosophy was to provide functional redundancy, i.e., interconnected systems, but both 
necessary to provide the required capacity to handle the full load. Capability for component 
isolation (removal from circuit), cross-strapping, charge control (automatic and manual), and 
system protection via by-pass functions was provided by commandable relays. 

Energy Source and Storage Subsystems — The primary energy source for the spacecraft was the 
Solar Array (SA) which consisted of two modules (wings) mounted on either side of the aft rack 
(Figure 5-2). With the vehicle in the normal orbital attitude and the SA deployed in the X-Y 
plane, the wing axes lay 40° ahead (toward the direction of flight) of the +Y axis and 40° behind 
the -Y axis. The wings tracked the sun through 360° about this axis using error signals generated 
by sun sensors located on each solar array wing. Signals generated by the sun sensors were pro- 
cessed in the Solar Array Drive Electronics (SADE) which provided power to control the array 
drive motor speed. During periods of eclipse the array was driven at a fixed angular rate by signals 
from the SADE. In addition, the rotation direction and rate could be controlled by commands. 
Each wing contained 1 1 panels. The average power output of the SA varied during the life of the 
spacecraft due to the seasonal intensity of the sun, the angle to the sun (beta angle), eclipse 
periods, and various factors which degrade the power output capability of the solar cells. During 
full sun, the SA supplied power to all the loads as well as for charging the two Type 40 nickel- 
cadmium batteries. The batteries supplied the total spacecraft load requirements during eclipse 
and supplied the surge loads when they exceeded the instantaneous capability of the SA. 

Power Distribution and Control — Power, instrumentation, and sun sensor signals were brought 
in from each SA wing through a Slip Ring Assembly which was coupled with the Drive Motor 
Assembly. A Charge Current Controller (CCC) was provided for each battery to control charging 
rate as a function of voltage and/or battery temperature. Manual charge control was provided by 
commands that operated relays to disconnect various segments of the solar array from the bat- 
teries. Power to the spacecraft subsystems and sensors was distributed, fused, and controlled in 
the Main Power Control and Distribution Unit (MPCDU). The MPCDU also contained the main 
power transfer switch that connected the batteries to the 28 VDC bus-, the power transfer relay, 
pyro test switch, and inverters, control relays and other vehicle power functions. The SA panel 
disconnect relays and the CCC backup manual charge control relays were also located in the 
MPCDU. 

Power Subsystem Requirements — Figure 54 is a summary of the Seasat power requirements. 
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The total average power requirement of 711 watts assumed a 100 pexcent duty cycle fox all 
sensors except the SAR where a 4 percent duty cycle was assumed. Figure 5-5 is a comparison of 
the power required with the power available for one year of spacecraft operation. During parts 
of the eclipse periods, the power available provided for the average power required but with no 
margin for contingency. The pre-launch plan required operational restriction, of the sensor duty 
cycle during certain beta angles in the event adequate power was not available to maintain battery 
charge. However, the standby power (all sensors off) was only 100 watts less than the full load 
(approximately 600 watts compared to the fuU load of 7 11 watts) because considerable heater 
power was required for the altimeter and scatterometer even in a standby mode. 

Power Subsystem Instrumentation — Over 208 parameters of the EPS were monitored by 
telemetry! Many of these were relay on/off, SA deployment monitors and similar measurements. 
The key instrumentation channels pertinent to this review are shown in Figure 5-6. This table 
gives the range and sampling rates for these critical measurements. The locations of temperature 
sensors are of importance to this investigation and are discussed below. Battery temperature was 
monitored by thermistors bonded to straps that connected various cells of the battery. Solar 
array temperatures were monitored by sensors bonded to the outboard panels (panel 11) of each 
array. The temperature of the SADE box was measured by a thermistor bonded to a printed 
circuit card located near the center of the box. 


Power Subsystem Operation 

All transfer of power and signals between the rotating solar arrays and the spacecraft’s elec- 
tronics was through a slip ring assembly associated with each array. Both power and returns from 
each of the 1 1 panels on each array, as well as the array temperature and sun sensor inputs, were 
connected through this assembly. Figure 5-7 is a simplified schematic of the primary power 
control system (solar arrays, batteries, charge current controllers, and power switching logic). 

Main Power Control and Distribution Unit — The control and distribution of the unregulated 
power to the various subsystems aboard the spacecraft were accomplished in the MPCDU. Fuses 
located in the MPCDU provided the power interface for sensors and other subsystems, except for 
a few mission critical loads that were supplied unregulated power directly from the 28 volt main 
bus. Power for the main bus was provided both directly from the solar array panels and also from 
the b^teries through isolation diodes. Control of the spacecraft bus voltage to within the specified 
28’^4 VDC range was accomplished during sunlight by open-circuiting sections of the solar array 
as the batteries were charged. During eclipse, the bus voltage was to be maintained by proper 
planning of loads so that the battery voltage would remain above 24.5 VDC. The MPCDU also con- 
tained the solar array panel interconnection and by-pass relays, enabling individual solar array 
sections to be connected in a large number of configurations to provide flexibility in charging the 
spacecraft batteries and supplying the load demands. A bus was provided from the output of bat- 
tery 2 to supply power directly to the pyrotechnic loads on the spacecraft; this pyro bus could 
be disconnected via ground command through the K3 relay. The MPCDU also provided power to 
the remainder of the power subsystem components, including the SADE and the CCC. Instrumen- 
tation was included in the MPCDU for the measurement of unregulated bus voltage and current, 
structure (ground) current, battery and pyro bus voltage, and relay status monitors. As shown in 
Figure 5-7, panels 9 and 10 on both the +Y and -Y array were connected directly to the main 
bus when their respective relays, K28 and K34, were closed. On this schematic, these relays are 
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shown in the status mearsurement (open) position, but in nonnal operation were closed. The 
unnumbered square symbols on the schematic simply indicate connection to the main bus. 
Provisions existed for connecting all the remaining panels directly to the main bus and by-passing 
the batteries in event of battery malfunction. This capability was provided through commandable 
relays K32, 33, 38, and 39. In normal operation, however, output from panels 1, 2, 3, and 1 1 were 
connected to the batteries through the K1 relays and output from panels 4, 5, 6, 7, and 8 were 
connected to the batteries through the K2 relays, both located in the Oiarge Current Controllers. 
Thus, considerable operational flexibility was provided in the design of the power subsystem. 

Charge Current Controller (CCC) - Battery charging was controlled by a separate CCC for each 
battery. The CCC consisted basically of two relays (K1 and K2) that controlled battery charge 
by connecting or removing sections of the solar array to the battery terminals dependent upon the 
battery’s voltage and temperature. A maximum of four array panels were connected to the battery 
by the K1 relay and a maximum of five array panels were connected to the battery by the K2 
relay. The number of solar array panels connected through each relay was commandable by means 
of interconnecting relays (K29, 30, 31, 35, 36, and 37) located in the MPCDU. Each of the CCC 
relays (K1 and K2) had its own driver circuitry, which determined the appropriate battery voltage 
level at which to remove sections of the solar array from the battery charge circuit. This voltage 
discoimect set point was dependent upon temperature such that the higher the battery tempera- 
ture, the lower the voltage set point. The set point characteristics of battery voltage versus tem- 
perature for the K1 and K2 relays are shown in Figure 5-8. The design of this circuitry was predi- 
cated on a knowledge of battery state-of-charge (SOC) as a function of battery voltage, with K2 
designed to open at a 90 percent SOC and K1 designed to open at a 95 percent SOC. Corres- 
pondingly, each relay’s driver circuitry reconnected the appropriate solar array panels to the 
battery when the battery voltage fell below a pre-set level that was dependent upon battery tem- 
perature. As a back-up safety feature, each relay was also controlled by battery temperature 
alone: K2 was designed to open at approximately 93°F and K1 at approximately 98°F. Closing 
of K1 and K2 with decreasing temperature was automatic. Another safety feature was the inter- 
leaving of panels from each array to each charge controller to provide some charging capability 
for each battery in case of failure of a complete solar array. This interleaving of panels from each 
array is shown on Figures 5-3 and 5-7. 

Normal Operation — The power subsystem was designed so that during full sun the sol^ array 
provided power to all of the loads as well as for charging the batteries. Both the K1 and K2 relays 
were normally closed allowing the batteries to charge. When the batteries achieved approximately 
90 percent of full charge the K2 relays opened, reducing the charging rate. The K1 relays were 
set to interrupt charging when essentially full charge (98 percent) voltage was obtained. When the 
spacecraft entered an eclipse, the batteries would assume the load, would start to discharge, and 
the voltage would drop. First K1 would close and, as the batteries were further discharged, K2 
would close. As the spacecraft emerged from the earth’s shadow the solar array became illumi- 
nated, charging was initiated, and the cycle repeated. The system was designed for the batteries 
to reach essentially full charge just prior to going into eclipse. During the eclipse, it was planned 
that the loads would remove about 1 2.5 percent of the rated capability of the batteries. 

Provisions for Malfunctions — In the event of anomalous automatic performance of the CCC, 
additional controls were provided so battery charging could be controlled by manual commands. 
The following is a list of possible malfunctions and corrective actions. 
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1. Relays Fail Closed: 

Relay driver circuit fails to open K1 or K2 relays. Separate override commands for each 
K1 and K2 relays were provided which closed a latching relay in the MPCDU which applied 
power to the selected GCC relay through back up circuitry. If sending the override com- 
mand failed to open the malfunctioning relay, the proper “SA panel off’ relay command 
would disconnect the appropriate panels from the charging circuit. 

2. Relays Fail Open: 

Relay driver circuit fails to remove power from K1 or K2 relays; i.e., relays stay open as 
battery voltage drops. Power to the offending CCC could be removed by sending the proper 
“CCC off’ commands. If removing power from the CCC did not correct the anomaly, a 
back up parallel latching relay could be activated to by-pass the K2 relay. 

In the event of a battery failure, its CCC K1 and K2 relays could be commanded open by the 
override command removing the battery from the system. The solar array panels assigned to that 
battery could then be connected directly to the bus by closing the proper “diode by-pass relays” 
(K32 and 33 for battery number 1 and K38 and 39 for battery number 2). 

Any failed solar array panels could be disconnected in groups. Panels 2, 3, and 1 1 ; 4 and 5; 6, 
7, and 8; 9 and 10 could be disconnected by opening the appropriate interconnecting relay. Panel 
1 could be disconnected by opening Kl, which also removed panels 2, 3, and 1 1. The sensors and 
other loads could be commanded off individually. 


Electrical Power Subsystem Flight History 

The EPS generally performed as designed from launch up to the time of the failure on October 
9, 1978, except for two anomalies, one on July 6 and one on August 28. 

Heater Thermostat Anomaly -- On July 6, 1978, the radar altimeter high mode thermostats 
cycled rapidly and there were indications that relay contacts intermittently stuck in the closed, 
heater power-on, position. The heater thermostats for the SASS also locked on but this was not 
discovered until the heater bus was cycled to relieve the high temperature condition on the radar 
altimeter. Subsequent investigation revealed that the thermostat was rated for an upper current 
limit of 3.0 amps while in operation the radar altimeter high mode heater was operated at 4.7 
amps, and the SASS heater was operated at 6 amps. Laboratory tests duplicated the failure and 
revealed that the failure mode was one of material transfer at the contact points. This transfer 
of material changed the gap between points and also caused the thermostat to stick. This failure 
necessitated manual rather than thermostatic control of heater power which, because of the less 
efficient operation, increased the average heater power consumption. This increased load was a 
contributing factor to the low voltage anomaly on August 28, but did not result in any damage 
to the electrical power subsystem. 

Bus Low Voltage Anomaly — On August 28, 1978, the altimeter transmitter turned itself off 
between active station passes because of a low voltage condition. This undervoltage developed 
because of a slow depletion of battery power as a result of the loads being slightly in excess of 
solar array capability. Figure 5-9 shows the unregulated bus voltage for several revolutions prior 
to the low voltage anomaly. These data indicate that, at least for six orbits, the batteries did not 
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reach a fully charged state; i.e., K2 did not open, thus indicating less than a 90 percent full charge. 
In fact, examination of the data after the failure of October 9 revealed that for three days preced- 
ing this low voltage anomaly none of the K1 or K2 relays had opened as they would have if the 
batteries were charged to a high level. As shown by the data of Figure 5-9 the battery charge was 
progressively depleted for each succeeding orbit during the eclipse and heater on periods. On 
revolution 892, with the altimeter off, the battery began to recover its charge. This information 
was not available to the flight controllers in real time because the low voltage point for these 
orbits did not occur during station passes. General information on the status of battery charge 
was, however, available to the flight controllers for several days from K2 relay status data. The 
lowest bus voltage experienced during this period was approximately 21.8 VDC; while the maxi- 
mum depth-ofdischarge cannot be accurately determined from the available data, it is estimated 
that the observed minimum battery voltage would be equivalent to that expected with almost 
100 percent of rated capacity removed from a 22 cell battery. This problem probably was due to 
a combination of the extra heater loads and insufficient understanding of the state-of-charge 
of the batteries. As a result the operation of the altimeter and SAR was restricted until normal 
operations were resumed on September 7, 1978. No equipment damage was sustained as a result 
of this anomaly and the EPS performed normally in subsequent orbits. 

EPS Status at Failure — From launch to the time of the failure on Rev 1503, no failure of any 
component of the power subsystem was detected. Anomalous behavior such as discussed above 
did not result in any significant degradation of the power subsystem. All indications are that the 
batteries were in a healthy state and all elements of the electrical power subsystem were operating 
properly prior to the failure. 


Slip Ring Assembly 

A more detailed description of the slip ring assembly is provided at this point, as a thorough 
understanding of this component is central to the development of the following sections of this 
report. 

General Description — The slip ring assembly flown on Seasat was produced by the Poly- 
Scientific company of Blacksbimg, Virginia. Its design, development, and parts fabrication had 
been completed for another earlier program that had been cancelled prior to flight. This design 
had required 14 power transfer rings, which were 0.17 inch wide, and 38 signal rings which were 
made 0.07 inch wide. For the Seasat mission, a larger number of power rings were required but 
their individual electrical loads were small enough to be accommodated by the narrower rings. 
This design was adapted for Seasat by simply using both wide and narrow rings for power. For 
Seasat, 30 of the slip rings were used for power transfer. The flight units were assembled from 
existing parts inventory. Slip ring serial number 1001 was assigned to the +Y array and serial num- 
ber 1002 was assigned to the -Y array. 

A photograph of a slip ring assembly of the Seasat design that has been partially disassembled 
to reveal the rings and brushes is presented in Figure 5-10. As can be noted, 26 of the brush 
assemblies were mounted on a brush block in the bottom half of the assembly. These brushes 
interleaved with the other 26 brushes that were attached to an upper brush block shown removed 
from the assembly in Figure 5-10. 
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For reference in this investigation, the assignments of the 52 slip rings as connected for Seasat 
are Ksted in Figure 5-1 1 . This figure identifies the solar array panel to which each ring was wired, 
and specifies polarity and function of each ring. All brushes were wired to exit connectors. Brush 
wires that were not functionally used were terminated at these connectors. All slip rings were con- 
nected to wires routed through the inside of the slip ring and drive motor shafts to the solar array 
assembly strut shown in Figure 5-1 2. Wires from the rings that were functionally used were spliced 
to leads from the applicable solar array panel. The wires that were not used were cut off approxi- 
mately 8 inches from the exit of the slip ring assembly and each end of the wire was dead ended 
with shrink tubing. These cut-off wires were placed back into the wire bundle to assure non- 
interference with solar array deployment. The numbering system for the rings was 1 through 52 
in sequence starting with the drive end of the assembly. The cable bundle at the drive end of the 
assembly contained the wires from the slip rings and was routed through the solar array drive 
assembly strut and outward to the solar array harness as shown in Figure 5-12. 

Significant Design Features — The array normally turned slowly with respect to the bus in a 
sun tracking mode. It turns in either direction, may remain stationary, or be slewed at rates of 
up to 15° per minute while transmitting power and signals. The electrical load through the slip 
ring assembly was approximately 25 amperes of current at voltages up to 33.0 volts or about 2.3 
amperes output from each solar array panel through its assigned slip ring(s) in the assembly. 

The slip ring rotor assembly consisted of individual slip rings on a fluted shaft, held in place 
by a potting compound that provided structural support and positioning to the rings and their 
soldered leads as well as dielectric insulation. The two types of brush and spring assemblies in 
the design flown on Seasat are shown in detail in Figure 5-13 (a and b). From these figures it is 
clear that the wide brush assembly, when mounted, straddled the slip ring assembly in a manner 
to bear on its mating slip ring from opposite sides. This resulted in having essentially a full over- 
lap between the interleaving wide brush assemblies that were mounted alternately from the top 
and bottom brush holders in the slip ring assembly. The narrow brushes shown in Figure 5- 13b 
sprung out when placed over the rotor so that a vertical gap of 0.04 inch typically resulted at 
assembly between the tips of narrow brushes. An appreciation of brush spacings when fully assem- 
bled may be seen by the photographs in Figure 5-14. 

In order to determine worst case clearances between adjacent brush assemblies, a stack up 
tolerance study was done by Poly-Scientific at the request of the Board. This analysis showed 
that mechanical interference between brush assemblies was possible. This analysis verified a 
judgment by the Board that the design was very congested and prone to trouble when minor 
discrepancies in assembly, inspection, or operating disturbances occurred. 

f 

Materials Used — Space applications of rotary power or signal transmission has been accom- 
panied by a long term, highly specialized development effort. In this effort on slip ring and 
brush combinations, Poly-Scientific has played a major role and has supplied various types of 
devices for most of the western world’s space missions. From this considerable experience, the 
coin-silver rings, which contain 90 percent copper, used together with brushes of 85 percent 
silver, 12 percent molybdenum disulfide, and 3 percent graphite were judged by the Board to 
be adequate and likely were the best available for the Seasat application. Questions of wear debris 
are ever present in these devices but actual wear for the Seasat application was expected to be 
minor compared to the spinning drum type of solar array applications that have been widely used 
with success for several years’ lifetime. 
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Critique of SKp Ring Assembly — fn the rather limited and specialized market that exists for 
slip ring assembly devices for space applications, the Seasat units were procured from one of the 
most proven sources available. The material choices were proper and had been well proven in 
flight. There were adequate numbers of quality personnel in the Poly-Scientific organization 
(about 10 percent of the 500 person workforce). 

The design value for brush contact pressure (5 to 6 psi assuming full contact) appears to have 
been proper in this application and the assigned tolerances were reasonable. Cramped space and 
limited access precluded pressure measurement in the preferable fuUy assembled configuration 
so the use of tooling fixtures was required. This technique results in less pristine measurements. 
The electrical load of 2-3 amperes applied to both narrow and wide rings was the same because 
of the improvised approach to adapt the existing design but resulting current densities were still 
conservative. The Poly-Scientific personnel, as expected from their experience, were generally 
aware and sensitive to potential problems from voltage Surges, corona, and intolerance to earth 
ambient exposure or operation when using the Seasat brush material. The slip ring assembly was 
sensitive to earth ambient operation because the molybdenum disulfide constituent serving as 
the lubricant in the composite could pick up moisture and exhibits a characteristic termed 
“filming.” This could cause electrical noise during earth ambient operation which would continue 
for a while in vacuum before the brush-to-ring contact surfaces became reconditioned and the 
noise was again reduced to acceptable levels. 

The overall adaptation of the mechanical design was unnecessarily crowded for the functions 
it had to perform for Seasat. It was inherently more prone to minor errors in positioning critical 
parts and to problems resulting from minor disturbances to those parts than necessary, even for 
a device of equal volume and weight. Poly-Scientific personnel were aware that the design was 
congested and did recommend relief in length and weight specifications from LMSC during the 
original development in 1973. This relief was not granted at the time because of program con- 
straints. In the case of Seasat, however, these same restrictions did not exist. All of the slip rings 
could have been of the narrow type, the dual wiring to more than one ring for a solar array panel 
lead was not required, and the eight rings that were not connected externally in the flight con- 
figuration could have been omitted. In summary, the policy of using existing equipment without 
modification introduced a significant risk in the Seasat application of the slip ring assembly. 

The major fault, however, was not in the design of the device as produced by Poly-Scientific, 
but in how it was wired into the power subsystem in application. In the case of Seasat, the wiring, 
as flown, was alternately plus and minus between most of the adjacent brush and ring pairs along 
the rotor axis in the assembly. The reason given by both LMSC and JPL for this wiring arrange- 
ment was that it was done to reduce magnetic moments. Consideration of magnetic moments and 
means of their compensation are normal design considerations. It is, however, only within the slip 
ring assembly that magnetic moments would dictate a particular wiring sequence, and here the 
wire routing was unspecified, and by virtue of the assembly process used, was to a degree unknown 
and uncontrolled. A test failure on another program, covered in Chapter VI of this report, demon- 
strated the vulnerability of this design to electrical shorts when adjacent brush assemblies are of 
opposite polarity. 

In the electrical area, it was also noted that Poly-Scientific used Teflon insulated wiring whic’" ’“s 
more prone to cold flow than other popular insulation materials. They did, however, have a f 
rationale for its application within the slip ring rotor assembly itself because in the curing < 
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pDtted assemblies the temperatures involved tend to crack the alternate insulating materials. 
For this application. Teflon was judged by the Board to be acceptable because this portion of 
the assembly was relatively free from sources of wire to metal pressure, being potted in place 
within smooth channels. For the brush assembly wires, there was some susceptibility to occur- 
rences of wire to metal pressures. For the brush wiring it would appear that a better insulation 
choice could be made for future applications as no high temperature potting is involved; how- 
ever, more space would have to be provided for wire routing when the more rigid type of insulated 
wires is used. 
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Figure 5-1 . Block Diagram of the Electrical Power Subsystem 
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Figure 5-3. Simplified Schematic Diagram of the Primary Power Control System 
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Figure 5-4. Average Power Requirements of the Spacecraft 
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Figure 5-6. Summary of KEY Electrical Power Subsystem Instrumentation 
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Figure 5-8. Characteristics of the Charge Current Controfler 
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Figure 5-9. Unregulated Bus Voltage During the Low Voltage Anomaly 
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Figure 5-11. Assignment of Seasat Slip Rings to Solar Array Panels and Functions 
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VI - QUALITY ASSURANCE AND FLIGHT READINESS 


Introduction 

This chapter will discuss the quality assurance and flight readiness requirements for the Seasat 
Program and the processes used to ensure compliance. The spacecraft requirements were contained 
in two contractually approved documents: (1) the Satellite Vehicle Specification (Part I and Part 
II), and (2) the Satellite Vehicle System Test Plan. The first section of this chapter will summarize 
the flow of requirements from the contractual documents through qualification into flight readiness 
and will document the Board’s evaluation of the Seasat “build” paper and the potential problems in 
the quality assurance systems actually used. 

During the early stages of the Board’s investigation of the Seasat failure, it became apparent that 
the Slip Ring Assembly was a prime failure candidate. The second section of this chapter will, there- 
fore, discuss the “heritage” of the Seasat slip rings. This will include a discussion of previous flights, 
ground tests and failure experience of similar units, and a detailed history of the specific Seasat slip 
ring assemblies from vendor assembly through certification of qualification for flight. 


Spacecraft Requirements and Documentation 

The two primary contractual documents on Seasat were the Satellite Vehicle Specification (Part I 
and Part II) and the Satellite Vehicle System Test Plan. There were 13 other documents which re- 
quired JPL approval, but these were primarily implementation and operations type plans; i.e., Data 
Management Plan, Quality Assurance Plan, etc. .One of these plans, the Reliability Assurance Plan, 
is relevant to this chapter and will be discussed herein. 

Part I of the Satellite Vehicle Specification established the performance, design, development, 
and qualification requirements for the Seasat mission. Part II of the specification established the 
product configuration and system test acceptance requirements. This specification is similar to a 
typical Part I, Part II Contract End Item (CEI) specification used for most NASA programs. 

The Satellite Vehicle Systems Test Plan established the test program for assembling, testing, mon- 
itoring and operating the Seasat spacecraft from manufacturing through launch. The Satellite Ve'hi- 
cle System included all LMSC furnished hardware and GFE installed in the Agena bus assembly and 
the sensor module. The test plan was the controlling test document and subordinate only to the 
Satellite Vehicle Specification. An evaluation was made regarding this flow of requirements and the 
interrelationships of LMSC and -JPL relative to control and the visibility of requirements. 

Compliance with Requirements — During the Board’s review, it was determined that a significant 
test required by the JPL approved test plan was not conducted. The Satellite Vehicle Test Plan 
required electronic assemblies to be subjected to eight cycles in thermal environment of which, as a 
minimum, two cycles should be in a vacuum chamber (acceptance test). The Slip Ring Assembly 
Component Specification, however, did not require a thermal vacuum test. This noncompliance was 
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not recognized by JPL or LMSC Systems Engineering until the present failure investigation vra.s 
begun. Discussions with LMSC and JPL personnel revealed that there was not a “closed loop^’ sys- 
tem to assure compliance with contractual requirements identified in the test plan. 

The fact that a component specification could be issued which violated a contractual requirement 
is indicative of a lack of checks and balances in the system. Another such indication surfaced in 
reviewing the qualification requirements. In at least two cases, to be discussed below, qualification 
requirements noncompliance was not documented. In fact, in the areas where the Board performed 
an in-depth evaluation, inconsistencies in requirements were noted in many cases. Most incon- 
sistencies were minor; however, the impression left was that both compliance with requirements by 
LMSC and the “check and balance” system at LMSC and JPL were deficient. 

Engineering Memoranda — Environmental derivations, test criteria, and detailed test requirements 
were documented in Engineering Memoranda (EM’s). The LMSC stated that EM’s were used to 
allow early generation of requirements while the spacecraft design was being finalized. A consider- 
able number of EM’s were developed during the course of the Seasat program, and it accordingly 
became very difficult to establish a documentation “trail” as to how test requirements were estab- 
lished, modified, and satisfied. In fact, two particular incidents were uncovered during detailed 
evaluation into the qualification status of the EPS components that point out the weakness of the 
EM system. 

In one case, the' Seasat environmental requirements specified a 5 minute per axis random vibra- 
tion level but several components were qualified by similarity to a program that required only a 3 
minute per axis vibration. This 5 minute per axis requirement was also specified in Part I of the 
Satellite Vehicle Specification. There was. no documented evidence that this noncompliance was 
acceptable. In the second incident, pyro shock levels for Seasat were not enveloped by the program 
to which the Seasat slip ring assemblies were “qualified by similarity.” While an EM stated that the 
slip ring assemblies are “not highly sensitive to pyro shock,” there was no documentation or analy- 
sis to support the stated conclusion. 

Because Seasat was a one-of-a-kind yehicle, LMSC did not smnmarize the requirements contained 
in the various EM’s into a single “baseline” document. A “baseline” document, with change control, 
would have been a systematic approach to assuring requirements were satisfied and would have 
provided a “feed-back” mechanism to all parties. The large number of EM’s produced in the Seasat 
program made it very difficult for LMSC to use the EM’s to manage the program and to assure 
continuity in requirements, as exemplified above, and equally difficult for JPL to effectively pene- 
trate the system. 

The Failure Modes, Effects, and Criticality Analysis — The Failure Modes, Effects, and Criticality 
Analysis (FMECA) prepared for Seasat utilized the Fault Tree Analysis Technique. In effect, this 
was a method for studying the factors that could cause an undesired event to occur and inputting 
these factors into a computer model to which probability data could be applied to determine the 
most critical and probable sequence of events that could produce the undesirable event. 

The Reliability Assurance Program Plan required that a FMECA be performed at the system level. 
Further evaluation revealed that “critical/new equipment” would also be subjected to an FMECA. 
Out of the 74 critical items identified on Seasat, only three were judged to require component level 
FMECA’s. These were the Command Timing Unit (CTU), the Telemetry Sensor Unit (TSU) and the 
Synthetic Aperture Radar (SAR) Anteima (supplier performed). 
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The FMECA for the EPS stated that there were sin#e point failures” and listed a number of 
redundancies, including main bus power supply channels, batteries, charge controllers, and others. 
Electrical shorts were, however, not included as possible failure modes; almost all of the effort was 
directed toward consideration of failure modes that would result in loss of solar array power, and 
the only slip ring assembly failure mode considered was “slip ring contact failure.” The lack of 
consideration of electrical shorts in effect prevented the FMECA from serving as a tool for directing 
attention to those portions of the system where electrical shorts could occur and led to the erroneous 
conclusion that there were no single point failure modes in the EPS. 

Component Specifications — Component specifications were used on Seasat to define the design, 
performance, acceptance, and qualification requirements of the major hardware items and sub- 
assemblies. Because the program intent was to utilize as much off-the-shelf hardware as possible, 
many existing specifications were red-hned and updated for the Seasat Agena bus. These red-lined 
specifications were then converted into component specifications by the Responsible Equipment 
Engineers (REE’s). After April 1976, a Program directive established that aU component specifica- 
tions on Seasat required the signature approval of Reliability Engineering, of Space Technology, and 
of the Chief Systems Engineer (CSE) in addition to the REE and the Program Engineer. Two speci- 
fications were released prior to April 1976 and never received the full complement of signature 
approvals. These two specifications were for the Slip Ring Assemblies and the Solar Array Drive 
Motors. Had the other three Engineering organizations reviewed the specifications, quite possibly 
the Slip Ring Assembly thermal vacuum test deletion may have been prevented and inconsistencies 
in the qualification requirements may have been avoided. The component specifications were not 
reviewed and approved by JPL. 

Qualification for Flight — The Seasat Program used the classical methods of qualifying hardware 
for flight. These were: 

a. Qualification by test to demonstrate the capability of an item to meet specification require- 
ments. 

b. Qualification by design similarity whereby an xmqualified item is compared with an item qual- 
ified by test to determine whether the requirements for both items and their configurations are 
sufficiently similar to justify not testing the unqualified item. 

c. Qualification by engineering analysis, independently or in conjunction with test and/or simi- 
larity, to meet a specific qualification in the specifications. The use of engineering analysis alone 
could not be used to satisfy all qualification requirements. 

In September 1976, the LMSC Seasat Project issued a directive creating an Equipment Qualifica- 
tion Review Board for the purpose of reviewing and approving all qualification and design similarity 
certificates. The primary membership of the board included the Program Engineering Managers, the 
Chief Systems Engineer, the Program Reliability Engineer, the Quality Assurance Manager, and the 
Applicable Space Technology Manager. This Board met every two weeks to review the status of the 
qualification program and to determine what additional tasks were required to qualify a given item. 
Status reports were issued by Program Reliability Engineering who tracked the qualification progress 
and documented open items. 

The qualification cycle concluded with a meeting to review all test data, design similarity state- 
ments, engineering analyses, and individual component pedigree packages. Individual Certificates of 


6-3 



QualiScation were issued that tlie spedfie component had been qualified to the intended 

environment and was acceptable for flight A JPL engineering representative attended these qualifi- 
cation review meetings but was not required to approve the qualification certificate. A JPL reliabil- 
ity representative attended approximately 25 percent of the review meetings. 

Review of Build Paper — An evaluation of the Seasat “build” paper was made with primary 
attention focused on the EPS. The review encompassed the electrical harness fabrication and 
installation, the “pedigree packages” on electrical components and assemblies, Nonconformance 
Reports (NCR’s) on anomalies encountered in assembly and test, vehicle assembly log books, and 
the vehicle acceptance summary. 

Because the Board’s failure analysis eventually identified the slip ring assembly as the component 
responsible for the Seasat failure, detailed “build” paper associated with this component only will 
be discussed in the next section. However, some brief observations are presented below that deal 
with other findings made during the course of the investigation. 

The NCR’s are used by LMSC to document nonconforming conditions and resultant dispositions 
and correction actions. In general, the NCR system at LMSC was found to be acceptable. At the 
Board’s request, LMSC reviewed, cataloged, and summarized all EPS NCR’s and made a conscious 
decision as to the possible effect of the anomaly in contributing to the Seasat failure. None of the 
nonconformances were judged to be contributory to the failure. 

Evaluation of the spacecraft build paper of the EPS indicated that the Air Force Plant Repre- 
sentative Office (APPRO) involvement, operating under delegation from JPL, was shallow. Inspec- 
tion coverage was concentrated at the system level with few in-process mandatory inspection points. 

Early negotiations surfaced the fact that APPRO could neither provide the number of personnel 
nor the required skill levels to perform electronic inspections. As a result of these negotiations, JPL 
elected to send three JPL inspectors on extended TDY to perform 100 percent solder joint inspec- 
tions and electronic component acceptance testing. While it cannot be stated that a more in-depth 
involvement by the government would have prevented the failure, it is the opinion of the Board that 
the depth of penetration was inappropriate and a more selective penetration would have been in 
order rather than a nearly total reliance on system level audits and shakedown inspections for the 
bus assembly operations. 


Slip Ring Heritage 

Previous Experience — Consistent with the basic philosophy of the Seasat program to use, to the 
maximum extent possible, standard flight-proven equipment, the solar array drive motors and slip 
ring assemblies for Seasat were adapted from another LMSC program. At the time of initial contract 
negotiations, this other LMSC program had just developed a slip ring assembly and was in the 
process of performing qualification testing. This slip ring was also being considered for still other 
LMSC programs and it was anticipated that the assembly would be a qualified and flight-proven 
design by the time Seasat was flown. As it turned out, however, the program for which the design 
was originally developed was cancelled after completion of slip ring qualification but prior to flight; 
however, one other LMSC program did fly a slip ring assembly of this design shortly before Seasat 
was launched. While the design of the slip ring assembly for Seasat and this “previously flown” 
program were identical, the wiring sequence of the individual rings and brushes was different in the 
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two programs. As noted in Chapter V, the Seasat slip rings were wired such tiiat most of the adjacent 
power brushes were of opposite DC polarity while the other LMSC program was wired such that 
adjacent power brushes had the same polarity. Tliis difference in how the slip ring assemblies were 
connected into the EPS thus became crucial to the heritage of the Seasat slip ring assembly; when 
the Seasat slip ring assembly became, in its application, connected in a manner that was different 
from its sole predecessor it became a unique, first of a kind component. 

Two significant problems were noted as a result of random vibration testing of the slip ring 
assemblies used for the other LMSC flight program. An isolation failure was found after vibration 
testing in two adjacent brush/ring circuits. The corrective action was to separate the brushes. Also, 
when the assembly was opened for this operation, a crack was noted in the brush mounting block at 
a mounting hole. This block was replaced on the failed unit and a “T” strengthener was added to aU 
identical slip ring assemblies, including the Seasat units, to distribute the mounting loads away from 
the mounting point. 

Failure History — Slip ring assemblies of the design flown by Seasat experienced two “non- 
conformances” that provide evidence of two separate failure mode possibilities. One of these was 
the isolation failure noted above on the other LMSC flight program that was indicative of a possible 
failure mode due to contact between adjacent brushes of opposite polarity. Another failure mode 
identified on one of the Seasat assemblies was caused by shorting of a wire to ground due to cold 
flow of the Teflon insulation in the region where hi^ stresses were imposed on the wire. This inci- 
dent will be described in a later section of this Chapter. 

Considerable evidence exists in published reports that the sliding friction between brushes and 
rings will generate debris particles that can accumulate and produce electrical noise or, in some 
cases, short circuits between adjacent rings and brushes. The LMSC experienced a shorting failure in 
a slip ring assembly used in ground tests of a control moment gyro prior to June 1977, which was 
attributed to accumulation of brush-generated debris and subsequent ^cing between adjacent 
power brushes. Discussions with engineering personnel from TRW, Ball Corporation, and Sperry 
Flight Systems have indicated that other aerospace contractors have experienced similar slip ring 
shorts in ground tests. As a result of their, experience with slip rings, Sperry initiated an experi- 
mental study of the possible effects of debris which will be described in Chapter VIII. While the 
Board recognizes that there are significant differences between the design and application of the 
Seasat slip ring assembly and these other units, experience illustrates a third possible failure mode 
due to shorting caused by contaminants or debris within the assembly. 

Seasat Slip Ring History — A portion of the build histo^ of components is assembled by LMSC 
into “Pedigree Packages.” These packages contain component drawings, a component specification 
including acceptance and qualification test requirements, NCR’s, and some vendor documentation 
including specified test plans and test records. Component selection for pedigree packages was 
determined by the Seasat Program Office and the Quality Assurance organization at LMSC. The 
Seasat slip ring assemblies were documented by such pedigree packages. Relevant component 
history not contained in the slip ring Pedigree Packages included vendor assembly and test NCR’s 
(including failure reports), assembly test procedures and records (including brush alignments and 
pressure checks and brush “run-in” procedures), and relevant vendor and customer correspondence. 

The timing of the Seasat contract was such that LMSC was able to acquire two partially as- 
sembled slip ring assemblies when another LMSC program referred to herein as Program A, was 
cancelled. Program A had initially contracted for 10 assemblies and, at the time of termination, had 
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accepted delivery of one qualification unit, one development unit, and two production units leaving 
^ partially assembled units at the vendor. The Seasat Program picked up two of these units and 
LMSC Program B picked up the additional units. Reference will be made to Program B in other 
portions of this report relative to test experience and use of Program B qualification testing as a 
basis for qualifying the Seasat slip rings by “similarity.” 

Program A personnel were informed by Poly-Scientific in late 1973 that the constraints placed 
upon the length of the assembly were found to be restrictive and that relief of the specifications 
would enhance reliability. Program A, however, could not relax the specification. Although the 
Seasat application was not constrained by length, the program desire to use available “off-the-shelf- 
hardware” precluded the development of a new unit having increased dimensional tolerances 
between the rings and brush assemblies with possibly enhanced inherent reliability. 

Seasat personnel initiated discussions with Poly-Scientific in late 1975 using the LMSC Program A 
specification as a baseline. On February 3, 1976, Poly-Scientific submitted its first written quote 
for two assemblies to be fabricated and tested per the Program A specification. This initial quote 
was not acceptable to LMSC and the REE and buyer responded on March 5, 1976, with a Seasat 
red-lined version of the Program A specification. It was in this March 5, 1976, specification that the 
Program A requirement for 1 0 cycles of thermal vacuum acceptance testing was deleted. This 
deletion occurred even though: (1) the majority of the Seasat electronic assemblies and electro- 
mechanical assemblies were subjected to a thermal vacuum acceptance test; (2) neither Seasat 
Reliability personnel. Systems Engineering persoimel, nor JPL personnel were aware of this deletion 
until the present failure investigation; and (3) the thermal vacuum test was contractually required 
and a waiver of the requirement was never issued. 

Upon pursuing the thermal vacuum deletion further, it was determined from interviews with 
involved personnel that the test was deleted during verbal negotiations between both the REE and 
the buyer at LMSC, and the vendor in order to reduce unit cost of the slip ring assemblies. The 
responsible LMSC program engineer approved the deletion but, at that time, there was no require- 
ment to coordinate specifications with the Seasat Program Reliability Engineer or the Chief Systems 
Engineer. The fact that a waiver was not issued on this and other contract noncompliances is 
indicative of a weak compliance system between Lockheed and JPL. 

On March 25, 1976, LMSC issued a formal Request for Quote (RFQ) to Poly-Scientific for two 
Seasat slip ring assemblies built to the March 5, 1976, specification with a requested delivery date 
of 1 year. On May 26, 1976, LMSC authorized contract go ahead for two slip ring assemblies at a 
unit price of $8,953.50. 

Researching the manufacturing history and fabrication and test anomalies at Poly-Scientific 
resulted in the following: 

a. There were four anomalies noted on slip ring unit 1001, Three were minor and appear to have 
had no real impact on assembly reliability. The fovuth anomaly was a Teflon wire short to an adja- 
cent ground lug. The repair action, approved by LMSC engineering, was -to insulate the ground 
terminal and repot with ES 222-2 cement. The damaged insulation on the wire was not repaired. 
This discrepancy report was not included in the vendor’s data package and consequently this failure 
was not contained m the LMSC Pedigree Package. 

b. Slip Ring Unit 1002 (-Y Solar Array) had the more significant anomalies noted during fabri- 
cation and test. These anomalies are summarized as follows: 
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(1) 9/20/76 — 80 minute run-in of brushes to rings at 100 ± 10 RPM. Run-in time should 
have been for 100 to 115 minutes. This discrepancy was missed and not documented. 

(2) 9/23/76 — discrepancy No. 146522-discolored rings noted after above run-in test. Unit 
had to be completely disassembled, brushes and rings recleaned, unit reassembled and another run- 
in performed. The exact run-in time was not recorded nor entered into the log book. 

(3) 11/12/76 — discrepancy No. 1 5 1 887— excessive noise noted caused by moisture pick-up 
in the brush material. Corrective action was to run the unit in vacuum at 14.4 RPM for 06 hours. 
No vacuum cleanup was performed after this 14.4 RPM run-in test. This run time was not entered 
into the log book. 

c. Review of vendor documentation and subsequent teleconferences with Poly-Scientific per^ 
sonnel revealed the following assembly technique and procedures: 

(1) The assembly planning documentation specifies that the brushes were to be aligned “in 
center of the rings.” This requirement was verified visually by the inspector, but no dimensional 
checks were made. Proper alignment of the brushes is dependent, therefore, on the inspector’s 
judgment. 

(2) Poly-Sdentific stated that the tolerances within the slip ring assembly could allow adja- 
cent brushes to touch. It is noted here that an identical slip ring assembly experienced an isolation 
failure during acceptance testing which was probably caused by adjacent brushes touching. (Pro- 
gram B hardware). 

Both Seasat slip ring assemblies were shipped froih Poly-Scientific on February 22, 1977. These 
units were received and accepted at LMSC on March 11, 1977, where they remained in storage until 
required for installation on their respective Solar Array Modules. 


In approximately July 1977, LMSC Program B, which utilized identical slip ring assemblies, made 
a wiring change external to the slip rings that separated the polarity arrangement of adjacent slip 
rings. By changing coimector pin functions, the power applied to individual rings was changed from 
a configuration in which adjacent rings were of opposite polarity to one having positive contacts on 
one end of the slip ring assembly and negative contacts on the opposite end. This wiring change 
significantly reduced the possibility of internal shorts within the slip ring assembly. 


The Seasat Chief System Engineer was contacted by a system engineer from Program B about this 
change in wiring in August 1977. The explanation given for the wiring change was a concern that 
the ascent vibration environment could cause adjacent brushes to make contact and thus produce an 
electrical short because Program B slip rings had power applied during laimch. The Chief System 
Engineer discussed this change with the Seasat program engineer and they decided not to make a 
similar wiring change because Seasat did not see the same launch vibration levels and because Seasat 
slip rings were not planned to be powered during launch. It is noted that in April 1978, a change in 
launch relay configuration was made which did apply power to the slip ring assemblies. In retro- 
spect, the decision not to change the wiring sequence for Seasat was a crucial one. When the other 
program changed its wiring' and Seasat did not, Seasat became the first program to fly a 52-brush 
slip ring assembly with adjacent brushes of opposite polarity. Had there been better visibility to the 
problems experienced with slip rings by both the j^dor and by other organizations within LMSC, 
the Seasat engineering managers may have been mjore sensitive to the failure%rone nature of this 
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complicated device and to the importance of the electrical polarity of adjacent brushes. Unfortun- 
ately, such visibility, which may only have needed to have been slight to have been effective, was 
lacking. 

Slip Ring Assembly Serial Number (S/N) 1002 was installed on the -Y Solar Array Module (SAM) 
on August 17, 1977. On August 30, 1977, an NCR was written because the mechanic “lost” an 
undetermined number of shim washers. 

Review of the installation drawing revealed that four number 10 washers were required between 
the solar array mounting structure and the slip ring assembly. The cover of the assembly is made of 
- thin sheet metal and is prone to “bow up” during installation operations. Because the mounting 
bolts go through the cover plate into the threaded holes in the slip ring body, the mechanic had to 
place the round washers over the bolts between the structure and the cover plate. It was during this 
operation that the mechanic “lost” the washers. The S/N 1002 Slip Ring assembly was removed 
from the solar array module, the cover plate removed and three washers were found. Because some 
areas were still obscured, an X-ray of the slip ring was taken. No additional washers were located. 
An NCR was then written against Slip Ring Assembly 1001 and no washers were found by either 
visual or X-ray inspection. It is interesting to note two things: (1) there were no downstream 
electrical functional checks after installation of the slip ring assembly which could have detected 
missing washers in the slip rings, and (2) it was never conclusively determined if all “lost” washers 
were found. 

The Solar Array Modules, including the slip ring assemblies, were shipped to the launch site in 
April 1978. The last reported anomaly on the slip rings was high contact resistance on unit 1002 
during interface tests performed when the Solar Array Modules were mated to the vehicle. The 
resistance reading recorded was 2.38 ohms; the specification value was 2.00 ohms maximum. 
The engineering disposition in the NCR was “use-as-is” because in-flight operation would decrease 
the contact resistance. 
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VII - MISSION OPERATIONS 


Overview 

Seasat mission operations were conducted under JPL management from a POGC located at GSFC. 
Spacecraft telemetry, tracking, and command support were provided by GSFC, utilizing the STDN 
through the NASCOM Network. Real-time POCC telemetry, display, and command processing were 
also provided by GSFC, along with off-line orbit attitude and maneuver computations, and com- 
puter support for power profiling. Figure 7-1 depicts the mission operations interfaces. 

Processing of whole orbit spacecraft tape recorder dump data was provided by the GSFC Infor- 
mation Processing Division (IPD) to allow playback in the POCC for spacecraft housekeeping “quick 
look” purposes. For non-real-time mission planning activities at JPL, GSFC prepared a project data 
package containing a complete 24-hour file of data from the tape recorder dumps, along with asso- 
ciated orbit, attitude, and command histories. 

The JPL mission planning system provided the POCC a weekly command request profile, from 
which GSFC generated the daily mission sequence of events and the command load file. This infor- 
mation then led to the development of the station pass plans used on the console. 

The LMSC provided GSFC with specialized attitude determination and power profile software 
programs that were used off-line in the POCC for spacecraft system management. ; 

The Seasat pre-mission operations phase began at JPL in March 1976, when mission operations 
planning and design started. The activity was transferred to the POCC at GSFC in January 1978, at 
which time team formation was accomplished and flight controller training began. 

Real-time operations support began on the day of launch, June 26, 1978, and continued on a 
24-hour per day, 7-day per week basis until operations were officially terminated on November 1 0, 
1978. 

Mission Control Team Organization 

The real-time mission control organization operating out of the POCC was the Mission Control 
Team (MCT) shown in Figure 7-2. Four MCT’s were organized to support Seasat mission operations 
around the clock. They functioned on a 4-day on, 4-day off basis, operating on two 1 2-hour shifts 
daily. AU four MCT’s reported to the JPL Seasat Chief of Mission Operations (CMO) or his designee, 
located at GSFC. Each MCT was composed of five people: one command operator,'a Satellite Per- 
formance and Analysis Team (SPAT) of three engineers, and one Assistant Chief of Mission Opera- 
tions (ACMO) serving as team leader. The ACMO was a JPL employee, while a Bendix employee on 
contract to GSFC served as the command operator who performed all the spacecraft command 
functions. 
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The LMSC provided the three SPAT engineers to each MCT. The SPAT consisted of the Lead 
Monitor Analyst (LMA) and two Assistant Monitor Analysts (AMA’s). The two AMA’s functionally 
split their responsibility between the spacecraft power subsystem and the attitude control sub- 
system. In addition, both AMA’s monitored specific sensor housekeeping data. The SPAT was 
responsible to the ACMO for spacecraft systems and sensor status, for health monitoring, for analy- 
sis of attitude control and power subsystem performance, for spacecraft anomalous condition 
response, and for provision, but not transmission, of commands for spacecraft configuration con- 
trol. Critical mission phases required augmentation of the SPAT by two system or sensor specialists, 
depending upon the mission phase. 

There were several support areas provided the MCT by the GSFC PCXTC Operations Support Team 
(POST), including uplink command processing, data operations, network support, data processing, 
orbit computation, attitude determination and maneuver computation, and power profiling com- 
puter support. 

The Seasat MCT operated from consoles located in the Mission Operations Room (MOR) in the 
POCC. The primary real-time data display system was a series of digital data formats of telemetered 
parameters, command functions, and other information, presented on console-mounted cathode 
ray tubes (CRT’s). Snapshots (hardcopies) of these displays could be made by a high speed printer 
at any time. Also, a series of data formats referred to as “snaps,” different from the CRT displays, 
could be printed out on demand by a high speed printer. These were used primarily as historical 
data to maintain manual trend plots and for power and attitude evaluation. Analog strip chart 
recorders were used by the MCT to monitor selected parameters in the power and attitude control 
subsystems. Interactive console keyboards provided the method by which the controllers communi- 
cated with the POCC computer and transmitted commands to the spacecraft. 


Mission Operations 

Low earth orbit missions require a different philosophy of mission operations than do deep space 
missions where the spacecraft is in continuous communications with ground stations for long 
periods of time. Earth orbit operations planning has to accommodate the “snapshot” nature of the 
data viewing concept inherent to this type of mission, where the flight controllers receive short 
periods of real-time telemetry data as the spacecraft passes in and out of station contact on each 
revolution. This situation requires designing an efficient mission planning system in order to prop- 
erly schedule flight events and activities to coincide with STDN station coverage on an orbit-by- 
orbit basis. It results in more complex data managerrient plans and procedimes in order to recover 
uninterrupted spacecraft telemetry information over a specific period of time. For example, on- 
board tape recorders have to be managed such that one is always recording data while the other is 
ready to be played back (“dumped”) to the ground. This continuous information is necessary for 
daily attitude, thermal and electrical power management, and for long term trend analyses; pro- 
visions therefore have to be made to recover the dumped data in a minimum turnaround time. 

In order to maximize the chances of survivability in case of a spacecraft anomaly in this kind of 
operating environment, flight controllers require mission rules and associated contingency proce- 
dures to “safe” the spacecraft before the anomaly cascades into total failure. To be effective, these 
rules and procedures must be well thought out, be as simple and clear as possible, and very impor- 
tantly, be capable of rapid execution. All creditable single point failure modes should be accounted 
for in the development of these procedures, using the results of FMECA’s or their equivalent. The 
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controllers, of course, have to be well-trained in spacecraft subsystems to be able to recognize the 
symptoms as presented on their displays and to quickly associate them with the correct anomalous 
condition in order to respond with the proper procedures. Finally, the flight controllers must 
rehearse all contingency operations with a sufficient number of reasonably high fidelity simulations 
to demonstrate their readiness to support flight operations. 

Seasat was the first low earth orbit project conducted by JPL since Ranger 2, and was also the 
first JPL project flown from the GSFC POCC. Investigation revealed that the Seasat operations 
personnel, with extensive deep space mission background and little experience in earth orbit opera- 
tions, were sensitive to the inherent differences between the two concepts, and, with two excep- 
tions, were able to satisfactorily account for this in their Seasat mission operations planning. These 
exceptions relate to deficiencies in the flight controller training and in the development of mission 
rules and procedures associated with the Seasat Agena bus, especially the EPS. There were also some 
areas of concern which adversely affected smooth operations. Discussion of the deficiencies and the 
areas of concern follow. 

The geographical separation between the project office and mission planning activity at JPL and 
the operations control center at GSFC, and between the spacecraft engineering activity at LMSC 
Sunnyvale and the operations control center, did present the obvious problems of travel and associ- 
ated costs during the period when the JPL/GSFC and LMSC/GSFC operational interface require- 
ments were being established. These were overcome satisfactorily. One serious problem due to this 
separation surfaced during the investigation which concerned the difficulty LMSC had in providing 
subsystem experts familiar with the Seasat spacecraft to relocate from Suimyvale to the GSFC area 
in support of mission operations. This will be discussed in more detail in the following. 


Training 

The Seasat MCT personnel received informal and formal classroom training before and after team 
formation at GSFC in January 1978, followed by “hands-on” simulation and test exercises, all 
conducted while at GSFC. The final objective of the training was to demonstrate readiness of the 
Project Operations System (POS) to support Seasat operations. This included the ground data sys- 
tems and associated persoimel as well as the MCT, to which this discussion is limited. 

The classroom training included orientation briefings and classes in various levels of detail on the 
POCC support facilities (hardware and software), project information (mission profile, project 
organization, data system, etc.), and spacecraft subsystem instruction (physical and functional 
description, constraints, etc.). 

The “hands-on” training was composed of six different kinds of exercises with all four MCT 
teams participating. During the first two, intra-team exercises and inter-team exercises, the MCT 
teams simulated the procedures required to conduct nominal mission phases (launch and early 
orbit, attitude trim, orbit adjust, etc.) exercising appropriate interfaces and procedures. Test tapes 
from LMSC of actual telemetry data and a GSFC POCC bit stream simulator provided the simula- 
tion sources for these exercises. Real-time and play-back data, along with command capability and 
with limited telemetry response, were provided the MCT although no spacecraft memory was simu- 
lated. The intra-:team exercises which followed extended to outside support functions. 

4 

In March 1978, an 8-hour Satellite /POCC End-to-End Data System Compatibility Test was 
conducted using the actual Seasat spacecraft at Sunnyvale, the STDN compatibility test van at 
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Sunnyvale to simulate an STDN station, the NASCOM drcuits, and the GSFC facilities including the 
POCC. The PCX^C exercised command fimctions such as spacecraft clock control, command and 
data system configuration, tape recorder dumps, telemetry modes, sensor sequence tests, and space- 
craft memory dump tests. Live telemetry was provided the MCT. All appropriate team interfaces 
were exercised. 

A series of combined POS simulated exercises for various mission phases were conducted that 
were very similar to the inter-team exercises, except that Portable Simulation System (PSS) equip- 
ment located at STDN stations and at GSFC simulated Seasat telemetry, thus bringing actual netr 
work personnel and equipment into the simulation. Limited telemetry responsiveness to command 
functions was available, and spacecraft memory capability was provided in this case to allow exer- 
cising memory loading and dumping procedures. 

A 12-hour long Operational Demonstration Test (ODT) was conducted in May 1978 which simu- 
lated launch through early operations (anterma and sensor deployment), with the actual WTR and 
STDN teams participating. The spacecraft test tapes and the PSS equipment provided the simulation 
sources. Four ground systems and two spacecraft anomalies were simulated dining the ODT, which 
was the only test exercise in the program where any anomaly simulation was performed on the 
console. 

The last series of “hands-on” tests was a SVz day Operational Readiness Test (ORT) conducted a 
week before launch. This mission “dress rehearsal” stepped through all mission phases, be^ning 
with launch. It combined all elements of the operations system, tested all interfaces, and used all 
three simulation sources mentioned above. The first 12 hours duplicated the ODT, exercising the 
WTR launch teams and an actual STDN station. In addition, an LMSC operational, readiness audit 
team provided a number of spacecraft anomaly cases that were exercised by the SPAT during the 
ORT time frame. These were “paper simulations” rather than actual hands-on simulations. 

Observations — Flight controller training and simulations were considered adequate in ground 
systems and data flow procedures. 

The spacecraft subsystem classroom training, however, was considered inadequate in that it went 
only to the level necessary to acquaint the flight controllers with the general characteristics of the 
subsystems. This level of training was insufficient to insure the capability of rapid real-time anomaly 
assessment. The contents of the LMSC Operations Training Manual were only to block diagram level 
and the LMSC Vehicle Schematic Document essentially contained a collection of wiring diagrams. 
There were no intermediate level schematics that presented subsystem end-to-end functional signal 
and power flow, which would have been ideal for operational training. 

The spacecraft subsystem “hands-on” training was also considered inadequate because there were 
only two spacecraft anomaly conditions simulated on-console during the exercises; these were a 
“satellite clock anomaly” case and a “no downlink” case. These anomalies were accomplished by in- 
puts from the telemetry simulator at an STDN station during the ODT where one or two individual 
parameters were varied to represent the specific fault. They were considered “open loop” from a 
flight controller response standpoint. The Seasat project did not have a high fidelity spacecraft math 
model as part of its simulation system which would have provided realistic “closed-loop” exercises 
to the flight controllers. Therefore, extra emphasis should have been placed on overcoming this 
situation as much as possible by conducting more on-console anomaly simulations. As a minimum, 
all anomaly cases listed in the operations documentation should have been run at least once for each 
team. 
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The Satellite fPOCC End-to-End System Compatibility Test, which was not originally in the 
program, provided the Seasat flight controllers a chance to see live data on their displays and to 
send actual commands to the spacecraft before launch. This type of test has proven very valuable in 
other programs in shaking out data flow discrepancies and enhancing the operations team readiness. 
It has also uncovered occasional spacecraft system discrepancies. In the case of Seasat, the test 
revealed several telemetry and command discrepancies onboard and within the ground system soft- 
ware, which were corrected. 

It was originally planned by the JPL project that LMSC would provide the operations team at 
GSFC with subsystem specialists who had followed the design, development, and testing of the 
actual Seasat vehicle from the beginning. However, LMSC could not comply with this plan because 
of the reluctance of these personnel to relocate for long periods of time from Sunnyvale to the 
GSFC area. In January 1978, LMSC was able to hire several engineers who were already living in the 
GSFC area. Most of these personnal were available to the Seasat Project because they had termi- 
nated employment with RCA, whose groimd systems Maintenance and Operations (M&O) contract 
with GSFC was being renegotiated at the time. For this reason, at 5 months before launch, the 
Seasat operations team received LMSC personnel who were proficient in ground systems operation 
but had little familiarity with the Agena bus. These former RCA employees, along with one engi- 
neer formerly with TRW and a Lockheed engineer from another facility on the East Coast, formed 
the four SPAT teams. The LMA’s were temporarily sent to Sunnyvale for briefing and test monitor- 
ing but the AMA’s remained at GSFC. All these persoimel received spacecraft classroom training at 
GSFC, performed by LMSC engineers using the Seasat Operations Training Manual. This entire 
situation resulted in the flight controllers responsible for subsystem health monitoring and contin- 
gency procedures not having the in-depth knowledge of the satellite systems Agena bus subsystems 
considered necessary to adequately cope with real-time failures. 

The M&O contract that RCA held with GSFC was put out on bid in 1977. After several months 
of negotiation, Bendix was notified on May 1, 1978, that they had been awarded the contract. On 
June 1, 1978, the switchover from RCA to Bendix occurred. A key member on each of the four 
MCT’s was the command operator, a GSFC-supplied contractor employee. In early January 1978, 
all four of these positions were filled by RCA personnel, who then went through the Seasat training 
program with their teammates. By Seasat launch, however, of the four trained command operators, 
three had left the teams. Other turnovers in the command operator positions also occurred. The full 
complement of four command operators, i.e., one for each MCT, was never regained through the 
remainder of the mission; three Bendix operators therefore supported four MCT’s. With only three 
operators available, the MCT’s never had a dedicated command operator to grow in experience as a 
member of a closely knit team. As a command operator would become accustomed to his team- 
mates and their uniqueness (and vice versa), team shifting would cause him to have to move to 
another team and start the process aU over. This complicated the ACMO’s task of building and 
maintaining proficient teams. 


Procedures 

Extensive capability for ground control of subsystem management and reconfiguration was 
provided the Seasat spacecraft by use of 317 real-time commands (RTC’s) that could be used for 
subsystem management and contingency operations. The normal usage was for reconfiguring the 
attitude control subsystem, the solar array tracking subsystem, and the sensors as required. Tape 
recorder management was also partially controlled by RTC’s. Contingency operations involved 
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transmission of RTC’s that reconfigured systems, switched in redundant equ^mient, or safed systems 
in the event of an onboard failure. 

There were cases where multiple RTC’s were required to effect the proper reconfiguration. There- 
fore, in order to minimize the time required for the flight controllers to pick out the proper RTC’s 
in real-time, arrange them in the proper order of execution, and transmit each of them separately, 
sequences of properly grouped RTC’s were designed for both normal usage and contingency opera- 
tion. These sequences were loaded into the ground system software so that the flight controller 
needed only to initiate a single execute command to transmit all the particular RTC’s required for 
configuration changes. 

Four sequences were created for contingency operation, with three of these associated with 
spacecraft safing for EPS anomalies and a fourth for attitude tumble recovery. These were as 
follows: 

Sequence 1 — “Programmer Inhibit” 

Prevented further on-board stored program commands from clocking out by dis- 
abling all memory banks in the operating command processor unit. 

Sequence 2 — “Sensor Power Down to OFF” 

Removed Sensor loads from unregulated bus. 

Sequence 3 — “Maximize Array Output” 

Provide full solar array output by closing all panel connect relays. 

Sequence 4 — “Condition RCS” 

Thermally conditioned and powered up the reaction control subsystem in case of 
an attitude control subsystem failure. 

Eleven anomalous conditions were selected for use in contingency operation planning which were 
as follows; 

a. Low battery voltage 

b. Array not tracking 

c. High battery temperature 

d. High current 

e. Over voltage 

f . Large attitude errors 

g. Attitude component failure— small errors 

h. Clock anomaly 

i. Programmer failure 

j . No downlink 

k. No response to uphnk 

Flight controller responses to these anomalous conditions were prepared and published in May 
1978 in two documents. One was the LMSC Seasat-A Operations Requirements and Constraints 
Handbook (ORCH), used by the SPAT personnel as their primary real-time procedural document 
for spacecraft control, and the other was the JPL Seasat-A Space Flight Operations Plan (SFOP) 
used by the JPL and GSFC personnel as their primary operations document. 
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The ORCH presented some oF the flight controller responses in “decision logic tree” diagrams 
while others were written statements in paragraph form. A chart was also included that attempted 
to summarize the reactions to all 1 1 anomalous conditions. The chart was not as complete or as 
specific as the narrative material. There were also some inconsistencies between the narrative mate- 
rial and the summary chart. 

The corresponding information in the SPAT section of the SFOP was more step-by-step “console 
procedural” oriented, with tabulated listings of specific procedures which included those for data 
collection. 

Both the ORCH and the SFOP specified safing sequences 1, 2, and 3 to be transmitted for 
anomalous conditions 1 through 4 (electrical power conditions). In addition, the ORCH stated that, 
if the condition were considered critical for conditions 1 and 2, additional loads should be removed 
by transmission of the “heater bus off’ RTC. It was not specified in either the ORCH or the SFOP 
which “current” was intended in condition 4, the two battery currents or the unregulated bus cur- 
rent, because it was to cover all three cases. The operator was to decide at the time, based on which 
telemetered current readings appeared abnormal. The prescribed action was the same, however, for 
all three current cases, that is, (1) determine the load source and disconnect the “offending” equip- 
ment, (2) transmit safing sequences 1 , 2, and 3, if the load source was not apparent, and (3) continue 
troubleshooting. One item open to interpretation in the documentation was the length of time the 
flight controllers should take in attempting to determine the load source before transmitting the 
safing sequences. 

Assuming that condition 4 applied to the two battery currents, the red-line values selected for the 
operators use in evoking the response to the conditions applicable to the failure were: 

Condition 1 (Low Battery Voltage) — 26.5 volts (minimum) 

Condition 3 (High Battery Temperature) — 60° F (maximum) 

Condition 4 (High Battery Current) — 1 8 amps (maximum) 

If these values were exceeded, the POCC computer automatically notified the operators by placing 
an asterisk next to the CRT parameter readout. 

Observations — The ground systems and the normal spacecraft operating procedures specified in 
the Seasat operations documentation (the ORCH and the SFOP) appeared adequate for proper 
conduct of the mission. However, the spacecraft contingency procedures were not considered 
adequate for operations. More emphasis should have been placed on identification of additional 
failure modes in the Agena bus EPS. This would have led to a more complete set of anomalous 
conditions and associated responses in the EPS than was documented. For example, a preplanned 
command sequence could have been prepared from available RTC’s that would have isolated aU or 
portions of the solar arrays from the power distribution and storage -subsystem should a short circuit 
arise in the solar array subsystem. 

There was no preplaimed true emergency safing sequence prepared to rapidly remove all loads 
except those absolutely essential to keep the vehicle aHve until troubleshooting could isolate a 
serious electrical failure. One such sequence could have been prepared from available RTC’s that 
would have quickly turned off all sensors, the heater bus, and aU nonessential loads. The only 
equipment that needed to be on in this critical situation was the S-band transponder, telemetry and 
command equipment, and some minimal attitude stabilization equipment. 
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Itoee of the anomalous conditions listed in the ORCH and the SFOP matched the symptoms of 
the Rev 1503 flight failure. These were low battery voltage, high battery temperature, and high 
current. (The documented high current condition should have been more specific as to which cur- 
rent was intended.) The specified flight controller response to these three anomalous conditions was 
the same— inhibit further clocking out of onboard stored program commands (transmit safing 
sequence 1), turn off aU sensors (transmit safing sequence 2), and maximize solar array output 
(transmit safing sequence 3). 

The contingency operations section of the ORCH should have been prepared with more attention 
to consistency between the anomalous condition/response summary chart and the narrative. Also, 
the procedures should have been more specific as to how long the flight controllers should take in 
attempting to determine the anomalous load source before transmitting the safing sequences, or 
whether the safing sequences should be transmitted first in all cases. It was not very clear in either 
case. Logic tree diagrams should have been prepared for all the conditions, not just a few. 

The availabihty of the Seasat spacecraft contingency operation data such as the anomalous condi- 
tions, reaction to these conditions, the safing procedures, and the red-line data with which to evoke 
these procedures, was very late in the premission operations period. This factor made it impossible 
for the flight controllers to properly analyze the data, learn the procedures, and prepare themselves 
for spacecraft contingency operation before launch. 


Operational Concerns 

Turnaround of Whole Orbit Data — The Seasat project had a requirement that “whole orbit data” 
be available in the POCC within 4 to 6 hours after GSFC IPD receipt of raw data, on a daily basis 
during certain critical mission periods such as orbit adjust/trim maneuvers and low power periods, 
and on demand at other times during the mission. Whole orbit data consisted of two revolutions of 
recorded data on the spacecraft housekeeping tape used by the MCT for spacecraft subsystem 
“quick look” purposes, and for power and attitude management. It was produced by IPD from 
spacecraft tape recorder dumps played in from the particular STDN station receiving the dump. 
Due to various problems within IPD and the STDN, the turnaround time was not met until near the 
end of the mission. In some cases the turnaround was as long as 1 or 2 weeks. 

This problem hampered the MCT SPAT personnel throughout the mission in performing proper 
trend analyses within a reasonable time. This excessive turnaround time could have been alleviated 
if the Seasat project had used the standard STDN-to-POCC direct reversed tape recorder dump tech- 
nique for POCC “quick look” data common on other space programs. 

r" 

POCC Data Processing — The effectiveness of any mission operations team is only as good as the 
quality of the data presented to them on the consoles. Team indedsiveness due to erroneous data 
indications during a spacecraft anomaly could result in a failure cascading into total loss of the 
spacecraft that might otherwise be manageable. A normal mission might even be severely jeopar- 
dized if the team takes improper action because of this kind of problem. 

Consistently high data quality was lacking in the Seasat operation for the entire mission. The 
problem centered around the POCC software program that processed the spacecraft real-time 
telemetry digital data transmitted from the STDN stations. This processing consisted of the conver- 
sion of the incoming raw data into parameters with engineering units. In most cases, the disCTepancy 
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that caused the erroneous display required one or more POCC computer reloads (“reboots”) to 
clear the problem. Although the situation did improve as the software program progressed through 
two major updates after the launch, random display problems continued to the end of the mission. 
For example, during the 2-week period just prior to the October 9 failure, 1 1 display anomalies 
arose where the computer required reloading to clear the problem. Three of these required two 
reloads, while two others required three reloads. The typical display characteristics of these prob- 
lems would include parameters randomly off-scale. 

Documentation — As stated previously, there were two Seasat operational documents containing 
spacecraft procedures. One, the Operations Requirements and Constraints Handbook (ORCH), was 
published by LMSC specifically for use by the LMSC SPAT personnel responsible for the spacecraft 
operations. The other, the Space Flight Operations Plan (SFOP) published by JPL, was a much 
btoader document to be used by all Seasat project personnel (JPL, GSFC, and LMSC). 

The existence of two sets of procedures left open the question of which was the governing docu- 
ment. This was complicated by the fact that they were different in format. This situation could 
conceivably delay timely real-time response to an anomalous condition, although there is no direct 
evidence that this occurred during Seasat operations. Operations plans are generally published to 
tell how a project will be operationally conducted, identifying the roles of the participating organi- 
zations. It should not list specific console procedures; these should be listed in a single document 
with more limited distribution, such as a console operating handbook, which is recognized as the 
authoritative program document for flight controller console operating procedures. 

Other than the overlap problem in spacecraft procedures, the ORCH and the SFOP served their 
purposes adequately, as did the LMSC Command Handbook and the LMSC Telemetry Instrumenta- 
tion Schedule. The LMSC Operations Training Manual was found to contain technically incorrect 
data, and the .LMSC Vehicle Schematic Document contained wiring diagrams not considered suit- 
able for operations. 


Real-Time Operations 

Revolution 891 Findings - The first low power period of the mission was expected in late August 
1978, and LMSC Sunnyvale thermal and electrical subsystem engineering specialists traveled to 
GSFC to monitor the spacecraft subsystem performance in the POCC during this period. They also 
provided technical support to the MCT personnel in those specialties. 

On August 26, an orbit adjust maneuver was executed on Rev 863, which required one solar array 
to be feathered to minimize reaction control jet impingement effects. The other panel had to be 
fixed also, but placed into position to provide maximum power. This was a standard operation, 
requiring all sensors to be powered down because of the low power state. The preplanned command 
sequences were used to conduct the operation. Full solar array output was not available for about 2 
hours during this operation. 

On August 28, the spacecraft entered the low power period, 2 days earlier than anticipated by the 
LMSC specialists. The MCT monitored real-time data during the STDN station coverage, which was 
limited to the peak portion of the charging cycle and the subsequent entry into the Earth eclipse, 
for six consecutive revolutions (886 through 891). Although neither of the K2 relays were ever ob- 
served to open during these 9 hours, there was no apparent concern with the POCC. In fact, on 
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Rev S91, a pclanned SAR. operation was conducted 20 minutes before entering the eclipse. About 
IV 2 hours after observing peak charging and eclipse entry on Rev 891 over the Hawaii STDN station, 
the MCT received their first look at Rev 892 live data over the Alaska STDN station. All spacecraft 
subsystems looked normal, with the exception that the altimeter transmitter was not operating as it 
had been during previous revolutions. The flight controllers first believed the altimeter had experi- 
enced a failure, but after some quick investigation, they concluded a power problem of some nature 
existed. At this time, they terminated sensor operation until the cause of the problem could be 
determined. 

A spacecraft housekeeping 'tape of Revs 890/891 whole orbit data was immediately requested by 
the MCT to provide “quick look” data. When this tape was delivered a little less than a week later 
and played into the POCC computer system, the MCT personnel and LMSC engineering specialists 
received confirmation of a very serious power situation that had been encountered due to extremely 
low unregulated bus voltage during Rev 891. It was obvious at that time that the altimeter had 
simply turned itself off due to low voltage. Other tape playbacks of previous orbits revealed the 
progressively lower voltage dips from Rev 886 onward, leading up to a 21 .8 volts minimum experi- 
enced on Rev 891 . Data showed the system recovered during the next revolution. The MCT did not 
resume normal sensor operation until September 7. 

Concluding that the spacecraft subsystem trend monitoring procedures were inadequate, the 
MCT SPAT personnel and LMSC Sunnyvale personnel immediately instigated a daily manual trend 
plotting technique using snapshot spacecraft health data from each real-time STDN pass. They 
recognized that more emphasis needed to be placed on K2 relay status as part of power manage- 
ment, and added a mission role that required both K2 relays to be open for at least two revolutions 
before operating the SAR. Tn addition, it was concluded that the power profile program needed 
recalibration because it did not include an estimated 35 watts being consumed due to the ineffi- 
ciency of manual heater operation as a resxilt of the July 6 heater thermostat anomaly described in 
Chapter VI. Software updates were planned to account for this recalibration, but the updated 
package was not delivered before the October 9 failure. The SPAT personnel had to manually input 
this increased power loading each time they ran the program. 

Revolution 891 Observations — Seasat electrical power management was not well understood by 
the personnel in the Mission Operations Room, at least not until after analysis of the events of 
August 28 when the serious low unregulated bus voltage drop occurred. Even though these person- 
nel and the visiting LMSC engineering specialists were fully aware of the first mission low power 
period, expected in late August, insufficient attention was paid to the battery charging state. This 
was exemplified by the lack of concern, with no power-down actions, when the K2 relays remained 
closed over at least the 6-orbit (9-hour) period before the Rev 89 1 minimum voltage dip, and by the 
conduct of an SAR operation with the K2 relays closed. — 

The problem was aggravated by the STDN station geometry during revolutions 886 through 891, 
which precluded the flight controllers from viewing the voltage drop which developed progressively 
over those six revolutions. The station acquisition period for each of these revolutions included the 
entry into the eclipse but did not cover the sharp voltage dip occurring afterwards. 

The analysis of the situation was delayed by the long turnaround time experienced by the MCT 
in receipt of the spacecraft housekeeping tapes. Even if a tape had been requested for Revs 886/887 
however and had arrived within the 4- to 6-hour specified time requirement, sufficient time would 
not have been available for the flight controllers to prevent the Rev 891 minimum voltage dip and 
altimeter trip-off. 
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The increased rigor in overall spacecraft subsystem monitoring procedures instigated after this 
low voltage problem resulted in satisfactory power management techniques for the rest of the 
Seasat mission. 


Revolution 1503 

Findings 

A sequence of events of activities and observations within the POCC Mission Operations Room 
(MOR) during Rev 1503 is presented in Appendix B. The sequence begins at 23:30 hours Greenwich 
Mean Time (GMT) on the Day of the Year (DO Y) 282 when Mission Control Team #3 assumed 
their positions on-console. The STDN station acquisition-of-signal (AOS) and loss-of-signal (LOS) 
times are shown and are based on station receiver phase lock times. All real-time command (RTC) 
activity is shown also. This sequence is shown ending several hours after Team 2 relieved Team 3 
on-console. Refer to Figme 3-1 for an orbital ground track of Rev 1503. 

' Pre -Santiago Pass 

As Rev 1503 began, tape recorder #1 was commanded by onboard stored program command 
(SPC) to begin recording, and recorder #2 completed its recording cycle and was ready for playback 
to the STDN. All vehicle systems had looked normal to the flight controllers during the Orroral 
station pass at the end of Rev 1 502. 

Santiago Pass 

The first indication of a problem became apparent-to the MCT at the Santiago station acquisition- 
of-signal (AOS). The ACMO was advised of the following out-of-limit indications: both battery 
currents off-scale high (greater than 51 amps), both battery voltages 24.7 volts, the urmegulated bus 
voltage 24.1 volts, the -Y solar array temperature off-scale high (greater than 860°F), and the +Y 
solar array temperature on-scale, but about 40° F offset above previous data. The AMCO was 
advised that all other spacecraft subsystems and the sensors indicated normal operation. Both bat- 
tery temperatures were reading about 84°F, and the SADE temperature was reading 98°F, but this 
data was not reported to the ACMO. The battery current, battery voltage, and battery temperature 
indications were all out of limits at this time, exceeding the mission rule red-lines to be used by 
flight controllers in exercising documented responses to the appropriate anomalous conditions. 

The team strongly suspected a ground data system problem because of the POCC data processing 
anomalies described previously. Many of these had display characteristics similar to those observed 
during the Rev 1503 Santiago pass, such as parameters off-scale. As a result, the ACMO requested 
that the POCC computer be reloaded. This was accomplished with the loss of 29 seconds of live 
data. Because the data indications did not change as a result, and because the SPAT personnel could 
not reconstruct or postulate an onboard failure mode that would be consistent with the telemetry 
indications, ground system problems were stiU suspected. Accordingly, the Santiago station real- 
time telemetry decommutation and computer telemetry processing programs were reloaded at the 
ACMO’s request. This action resulted in a loss of 32 seconds of live data. As before, the data indica- 
tions did not change after this action was completed. 

Out-of-limit indications were still present to the MCT at Santiago loss-of-signal (LOS). The battery 
currents had returned back on-scale although they were very high, the battery voltages and the 
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unregulated bus voltage were decreasing, and the battery temperatures were still abnormally h^L 
Because the operators were unable to identify the specific anomaly, they felt that no spacecraft 
reconfiguration action should be taken; therefore, no RTC’s were transmitted during this 13-minute 
pass. 


Santiago Post-Pass 

The flight controllers reviewed the “snapshot” data very intently after the Santiago pass, attempt- 
ing to the best of their ability to determine the source of the problem, but were unable to do so. 
During this 16-minute period before Orroral AOS, the team reviewed a “snapshot” of the POCC 
computer convert tables made during the Santiago pass. These were the calibration data tables used 
to convert incoming raw data to processed data in ehgineermg units. No discrepancies were noted, 
although insufficient time was available to do an in-depth analysis. 

Orroral Pass 

The Orroral station was not originally planned for Seasat support during Rev 1503, but due to 
the anomaly the ACMO had arranged through the GSFC operations support personnel that the 
station be available. It was a fringe pass with only about 9 minutes of real-time data available. At 
AOS, the anomalous telemetry indications were stiU present and continuing to diverge. The MCT 
decided to make one final attempt to rule out ground system problems by requesting the POCC 
computer operators t6 switch from the on-line disk storing the Seasat data base to the standby disk. 
This was attempted, but for some reason the computer would not run on the secondary disk, so the 
ACMO requested a return to the primary disk. This switching activity resulted in almost 4 minutes 
of lost live data (almost 50 percent of the total pass coverage). 

The ACMO had planned a tape recorder playback at Orroral, but by then, there was insufficient 
time to do so. By Orroral LOS, the team was convinced that the problem was not a ground prob- 
lem, but was within the spacecraft; because they could not locate it, however, they decided against 
any real-time safing command sequence transmission. 

No further acquisition was made with Seasat after Orroral LOS. 

Orroral Post-Pass 

A playback of Orroral pass data about 15 minutes after Orroral LOS confirmed that the ground 
system was not at fault. At 43 minutes after Orroral LOS, the official declaration of Seasat space- 
craft emergency was issued. The first transmission of a safing sequence occurred at about this same 
time, when Sequence 2 (“Sensor Power-Down to OFF”) was transmitted without communications 
with the spacecraft during the predicted Merritt Island STDN station acquisition. 

Safing sequences, along with the “No Downlink” command procedures, were transmitted re- 
peatedly from then on until termination of mission support, to no avail. 

At 08 :30 GMT, the ACMO requested that the GSFC IPD process a “quick-look” housekeeping 
tape of the Orroral Rev 1502 tape recorder #1 dump data to play into the POCC computer in order 
to determine if any trends leading up to the failure were present, and to see if the problem occurred 
during the recording cycle. The tape was delivered to the POCC 12 hours later, and a playback into 
the POCC computer revealed no onboard anomalies to the flight controllers. In other words, the 
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data through 01 ;37 GMT, Rev 1502, looked normal. The recorded data subsequent to that time (full 
cycle on tape recorder #2 and a partial cycle on tape recorder #1 ) was never dumped to the ground. 

Revolution 1503 Observations — The telemetered indications from the Santiago and Orroral sta- 
tions during Rev 1503 contained the symptoms of a serious failure in the Seasat spacecraft EPS. 
The MCT on duty, however, was unable to postulate a failure consistent with these indications in 
time to take possible corrective action. Out-of-limit indications were present for the low battery 
voltage, high battery temperature, and high current conditions, but no spacecraft sating action was 
taken in response to those indications. This was a technical violation of the mission rules (“responses 
to anomalous conditions”) published in the Seasat mission operations documentation. 

The MCT genuinely believed they were experiencing a ground system data processing problem 
rather than an actual spacecraft system failure. They were so convinced of this situation that several 
minutes of real-time telemetry data were lost while pursuing this belief. Contributing directly to this 
situation were the repeated POCC computer processing problems discussed previously, because 
many were similar in nature to those observed by the flight controllers during Rev 1503 (off-scale 
parameters, for example). 

A prelaunch failure was experienced in the Seasat telemetry and sensor interface unit (TSU), 
which, if it were to occur in flight, would have resulted in anomalous data indications somewhat 
similar to those observed during Rev 1503. The flight controllers were aware of this failure, which 
certainly influenced their thinking during their attempt to determine the source of the out-of-limits 
indications. 

Contributing to the lack of ability of the MCT to determine the failure mode was the minimal 
spacecraft subsystems (Agena bus) training received by the entire operations team. In addition, the 
SPAT member who was on duty serving as the AMA specialist in charge of electrical power was 
being cross-trained into that position during the time of the failure. His previous experience was in 
the Seasat attitude control subsystem and he had little, if anyr background in the electrical power 
subsystem. 

It was unfortunate that the tape recorder playback was not accomplished at Orroral from Rev 
1503. From the standpoint of obtaining the recorded failure event, however, the wrong recorder 
probably would have been dumped. Tape recorder #2 completed its record cycle and was ready to 
be dumped about one-half hour after LOS at Orroral, Rev 1502. Tape recorder#! began recording 
just before this and actually recorded the failure a few minutes later. All this activity happened out 
of station contact during the hour between LOS at Orroral, Rev 1502 and AOS at Santiago, Rev 
1503. So not knowing where in this hour the failure occurred, the flight controllers would naturally 
have dumped recorder #2 which was full and in standby, awaiting playback, rather than recorder 
#1 which was still recording during the Rev 1503 Santiago and Orroral passes. (It takes longer for 
the ground to set up and dump a recorder still recording than it does for one which is fuU and in 
standby to dump.) Even with the minimum time specified for spacecraft “quick look” tape turn- 
around, the MCT would not have known in time that they had dumped the recorder that did not 
contain the failure event. 

As it turned out, the Oak Hangar (UKO) European Space Agency (ESA) tracking station in 
England recorded the Seasat telemetry during the failure event; data covering the failure event was 
therefore available for post-flight failure analysis. 
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Mission Operations Conclusions 

a. There is no indication that any aspects of mission operations were contributory to the Seasat 
Failure. 

b. Although the MCI on duty during Rev 1503 technically violated mission rules by delaying 
any safing action to the spacecraft, for whatever reasons, it' is the judgment of the Board that if this 
action had been taken during either the Santiago or Orroral station passes, given the existing depth 
of training, the documented contingency procedures, and the actual failure mode, the Seasat mis- 
sion would not have been saved or partially saved. 
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Figure 7-2. Seasat Real-Time Mission Control Team (MCT) (Typical of 4 Teams) 



VIII - IDENTIFICATION OF THE FAILURE MODE 


Isolation of the Failure 


On revolution 1503 of the Seasat mission, the spacecraft data recorded at UKO showed that 
all subsystems were operating normally at AOS. At 03:06:13 GMT the spacecraft entered eclipse, 
and all subsystems continued to operate normally with the batteries assuming the spacecraft loads. 
At 03:12:02 GMT the unregulated bus voltage decreased from 29.2 to 25.2 VDC in approximately 
17 seconds, coming to an essentially steady state condition. Battery currents increased from a 
normal value of 10 to 12 amps each to a full scale high value of 51 amps, with a single intermedi- 
ate measurement on each battery of approximately 40 amps. Figure 8- la. Battery voltage fol- 
lowed the unregulated bus voltage and battery temperatures increased sharply in response to a 
heavy current load of at least 100 amps placed upon them. Solar array temperatures exhibited 
abnormal behavior with the -Y solar array temperature indication abruptly going to full scale. The 
+Y solar array temperature indication assumed a steady state offset but continued to function 
normally. Figure 8-lb. 

Examination of the principal power subsystem parameters displayed on an ©cpanded time scale of 
1 second per inch, in Figure 8-2, showed that the unregulated bus voltage decreased m a successive 
series of steps over the first 17 seconds of the event. The battery current indication of 40 amps per 
battery occurred during the first step of the unregulated bus voltage drop. Unregulated bus current, 
however, indicated no change in characteristics after the fault. Structure current showed minor 
abnormal behavior at the initiation of the unregulated bus voltage drop, and again 1 2 seconds later, 
and abruptly returned to normal. Except for these two relatively minor and short lived events, the 
structure current showed no permanent abnormal behavior. 

Examination of the EPS high bit rate data displayed at 0.250 seconds per inch, in Figure 8-3, re- 
veals that the initiation of the fault resulted in an unregulated bus voltage drop from 29.06 to 28.2 
VDC that lasted for approximately 600 milliseconds. Unregulated bus current indicated only one 
abnormal data point. A single bit error in the most significant bit of this data word would, however, 
bring this current indication to within the normal pattern of the unregulated bus current. Also, sev- 
eral data indications of the structure current show slightly different behavior during the initiation of 
the fault, but these differences were minor compared to the major fault current of 100 amps or 
more. These flight data clearly indicate that a massive and progressive short circuit occurred within 
the EPS. The short circuit did not involve the unregulated bus or cause any significant permanent 
change in structure current indicating that a short circuit did not occur in any of the spacecraft 
loads, and no short occurred to ground. The short, therefore, occurred between the positive and 
negative power lines within the -EPS. 

These conditions existed in the EPS as the spacecraft passed out of view of UKO approximately 
1 minute after the initiation of the failure. 
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AOS at the AGO station occurred at approidinateiy Q3i30 GMT, or 17 minutes later. The unregu- 
lated bus voltage had dropped to 24.1 VDC and the bus current was normal for this voltage. Battery 
voltages had also dropped, battery currents were still full scale high, and battery temperatures were 
high (85°F) and rising. These data indicated a continuing massive fault that was now essentially 
steady state. The solar array temperature indications remained abnormal with -Y full scale hi^ and 
+Y operating normally but with a 40°F high offset. The temperature of the SADE had increased to 
97.5®F and continued to rise. During the AGO pass, both 1K2 and 2K2 relays opened, a normal 
response to the high battery temperatures. The opening of 2K2 coincided with an increase in bat- 
tery and unregulated bus voltages, which indicated that a portion of the short had been relieved. 
About 1 minute before LOS at AGO, the spacecraft emerged from eclipse, the solar array began 
sharing the loads, and the battery currents came back on scale but were still very high. All sub- 
systems of the spacecraft except for the power subsystem were normal throughout the AGO pass. 

As indicated, the SADE temperature during the AGO pass was elevated and slowly rising at a rate 
of 1.53®F/min. The SADE was thermally isolated from the structure through vibration isolators 
and from solar radiation by multilayer insulation. Analysis of the SADE thermal characteristics 
indicated it would require between 50 and 70 watts of thermal energy to produce the indicated 
temperature rise rate. The SADE continued to function normally, thus producing no excessive 
thermal dissipation. As no major power cables passed through the SADE, there was no source avail- 
able internal to the SADE to produce the required heat. The -Y solar array cable bundle, however, 
ran the length of the SADE in close proximity to it and underneath the multilayer thermal blanket. 
A thermal analysis indicated that a fault current of the indicated magnitude passing through four to 
eight wires of this cable harness would produce sufficient thermal energy to cause the temperature 
rise rate exhibited by the vSADE. This led to the conclusion that the fault current passed through 
the cable adjacent to the SADE. The fault must, therefore, have occurred on the solar array side of 
the SADE, because if it had been on the vehicle side, no fault current would have been flowing 
through the section of the cable adjacent to the SADE and no temperature rise would have resulted. 

Localization of the fault to the solar array side of the SADE placed the fault within the cable 
between the SADE and thp -Y slip ring assembly, within the -Y slip ring assembly, or on the solar 
array or in its cabling. The cable run between the SADE and the slip ring assembly was a short, 
straight cable of Kapton insulated wire with no splices. A short here would have to have been a 
wire-to-wire short which is highly unlikely with Kapton insulated wire. In addition, no reasonable 
propagation mechanism could be postulated for a wire-to-wire short; this section of cable was there- 
fore not suspect. 

Flight data of the solar array positions showed that both solar arrays continued to be driven at 
the programmed rate rmtil considerably after the initial event indicating that both solar array drive 
assemblies were functioning normally; the -Y solar array drive assembly was therefore not suspect. 

Examination of the remainder of the solar array layout indicated three potential shorting possi- 
bilities. These were: (1) solar cell string-to-battery return; (2) isolation diode on panel-to-battery 
return cable; and (3) a wire-to-wire short in the cable. All of these were examined to see if they 
could match the initial fault flight data but none of the potential failure modes on the array could 
be made to fit. In addition, the construction of the arrays was such that none of the potential fail- 
ure modes were considered likely, and no propagation mechanism could be found in any of these 
areas. It was concluded that the fault was not on the solar array or in its cables. 

The elimination of all other elements of the EPS localized the fault to the slip ring assembly. The 
initial event was then characterized by using resistance values corresponding with the spacecraft 
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cable length and the observed flight data values for current and voltage. Also, the design of the EPS 
was such that the positive and negative wires in the vehicle cable run were equal in length with the 
same number of connectors in each liiie and therefore they had the same electrical resistance. The 
known electrical resistance in the positive and negative cables with the unknown short resistance 
between them form a voltage divider, and since the flight data provided the voltage and current of 
this electrical circuit, the unknown fault resistance and voltage drop could be easily determined. 
The resulting parameters were as follows: 


Fault current 

60 amps 

Fault voltage 

10 volts 

Fault dissipation 

600 watts 

Fault duration 

600 ms 

Fault resistance 

0.2 ohms 


Further investigations were directed toward finding a probable initiating mechanism within this 
assembly. 

Slip Ring Failure Modes 

A detailed review of the slip ring construction, assembly procedures, and failure history permitted 
the synthesis of three possible failure modes within the slip ring assembly which were as follows: 
a wire-to-brush assembly short; a short between adjacent brush assemblies; and a short by particle 
contamination. 

Wire-to-brush assembly short — In this failure mode, the Teflon insulated wire could press against 
a brush assembly in a way to cause cold xflow of the insulation and ultimately cause a short. The 
application of this failure mode to the fault parameters had two shortcomings. First, a short of high 
impedance would not be likely, and secondly, the short must dissipate 600 watts of power. A ther- 
mal analysis indicated that, if this amount of power were to be dissipated between the wire and the 
brush spring, the wire would be heated to its melting point in significantly less time than the dura- 
tion of the observed initial short. Such a short would then bum the wire open, with the shorted 
wire acting as a fuse. Therefore, whule this failure mode could possibly cause the initial shorting 
event, some additional mechanism would have to be triggered by this mode which could explain the 
observed flight data. As will be discussed below, this additional mechanism could be a sustained 
electrical arc. 

Contact short between adjacent brush assemblies — As discussed in Chapter V, the clearances 
between brush assemblies are small at best, and slight misalignments could make these distances 
even smaller. Figure 8-4 is a photograph of a non-flight Seasat slip ring assembly showing the brush 
assignments for brushes 1 through 15. The large areas of overlap between the wide brush assemblies 
and the clearances between adjacent brush assemblies can be seen easily. As noted in Figure 8-4, 
most of the brush assemblies are wired such that opposite polarities exist on adjacent brush assem- 
blies. Contact between adjacent brushes is considered quite possible and, if such contact occurred 
between brush assemblies of opposite polarity, this could trigger an arcing short having the charac- 
teristics of the initial fault. 

Short by particle contamination — Ground tests of slip ring assemblies using sintered composite 
of silver, molydisulfide, and graphite brushes have demonstrated that debris produced by brush 
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wear can cause failures due to shorting. One failure mode is caused by relatively small debris, prin- 
cipally silver, building up on the insulating barriers between adjacent brushes and producing a 
conductive path. In this case, a very small deviation from nominal brush position, for any reason, 
could result in brushes contacting the dielectric material between rings and severely aggravating 
wear rates. Also, large debris particles that were either undetected before launch or generated by 
malfunction cannot be dismissed as possible failure modes. This debris could introduce a shorting 
condition between closely spaced adjacent parts of opposite polarity as was the case for the Seasat 
slip ring assemblies. Debris-caused shorting has been observed in high speed slip ring applications 
where many rotations are experienced. The Seasat application was very low speed and the slip ring 
assemblies experienced a relatively lOw number of rotations before mission termination; however, 
the generation of some amount of debris would have been normal and the amount could have been 
exaggerated by minor faults. This debris or contamination could have led to the above described 
shorting or could have exacerbated the previously described possibility of shorting between mis- 
aligned brush assemblies. If any one of these debris-induced shorts produced electrical arcs, it could 
explain the observed flight data. 

In smnmary, any of the above described slip ring failure modes could produce an electrical short 
between either adjacent brush assemblies or adjacent rings having opposite polarity. By themselves, 
however, none of these shorts could produce the flight data observed during the initial shorting 
event unless it was a trigger mechanism for a sustained electrical arc. Additionally, this arc would 
have to lead to still other shorts involving additional circuits which would provide the current 
carrying capability to ultimately drain the batteries and cause failure of the EPS. That arc initiation 
is in fact possible due to at least one of the above described failure modes was proven conclusively 
in a laboratory test program described in a report from Sperry Flight Systems. The subsequent sec- 
tions of this chapter describe the results of this test program, compare the results with the Seasat 
flight data, and discuss the possibility of sequential propagation of the arc induced fault. While the 
Sperry study describes arc initiation caused by relatively large debris particles, the Board considers 
it possible that similar arcs might also be initiated within the slip ring assembly by either wire-to- 
brush assembly shorts, contact shorts between adjacent brush assemblies, or from abnormal amounts 
of small particle debris. 


Arc Initiation and Maintenance 

Sperry Flight Systems^, Phoenix, Arizona, who has used slip rings with the same brush material, 
brush spring material, and similar brush-to-brush clearances has conducted an investigation of a fail- 
ure mechanism that can be initiated by contaminants. Tests were run in a fixture containing sim- 
ulated slip ring bmsh assembly springs, with Clearances similar to the Seasat flight hardware 
(Figure 8-5). The purpose of tests conducted with this apparatus was to determine the nature and 
extent of arcing shorts that might be initiated by debris. 

A schematic drawing of two adjacent slip ring and brush assemblies is shown in Figure 8-6. Low 
level steady state currents pass in opposite directions in the two brush leads and brushes. If a short 
is introduced across these two leads, the total current in each lead will increase significantly and a 


^Substantial portions of this section were derived directly from Sperry Flight Systems, Phoenix, Arizona, Report 
No. 120181, “Effects of Material Wear Debris on Power/Slip Ring Components in Vacuum,” by Mr. P. E. Jacobson, 
April 1978, and are used herein with the permission of Sperry Flight Systems. 
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three-diTnensional magnetic field will be set up around the conducting elements as shown in the 
figure. As can be seen, the particle will be forced out of the magnetic field set up in the vicinity of 
the brush leads by reason of its own field developed by the short circuit. This mechanism would 
exist even if the two lead wire polarities were reversed. 

The inherent particle ejection would be desirable were it not for an arcing phenomenon that is 
triggered by this ejection. As the shorting particle is ejected, it is possible that an electrical arc may 
be initiated which would result in more severe damage to the circuit elements than the particle itself 
could produce. The mechanism of this arc buildup and decay is described in the literature and is 
summarized in the following paragraphs. 

As a shorting particle between adjacent brush leads separates (particle ejection), the temperature 
of the material adjacent to the point of contact increases to the melting point due to very high local 
current density resulting in extremely high local temperatures. This phenomenon is common in 
make/break power circuits. Figure 8-7 shows the sequence of events that occurs when a shorting 
particle bridges opposite polarity power elements. In Figure 8 -7(a), the shorting particle produces 
the short circuit path that in turn creates high local heating and melting. As the magnetic forces 
begin to eject the particle, the fluid material is drawn out by surface tension with further separation 
as shown in Figure 8-7(b). This is known as the bridge stage of the separation. After complete 
particle separation from the cathode, the cathode cools and final rupture of the liquid metal leaves 
a buildup of material at the cathode. The temperature of the bridge formed at the cathode can be 
high enough to cause thermionic emission of electrons from the cathode to the anode. This elec- 
tron flow continues the short circuit path even after the initial shorting particle is no longer present. 
The continuation of the arc, through the thermionically emitted electron stream, continues to heat 
the anode which locally melts and produces an ionized gas environment providing the necessary 
ingredients of an arc as shown in Figure 8-7(c). The anode will then sacrificially feed the arc until 
the arc length becomes long enough, several inches in vacuum, to reduce the current to a threshold 
below which the arc cannot be sustained. The destructive nature of this mechanism is obvious. 

A fully developed arc has a voltage distribution across the arc as shown in Figure 8-8. Although 
the exact profile is a function of the materials involved, the figure approximates the conditions 
which prevail. Of primary importance is the fact that the major elements of the total voltage drop 
are the cathode plus anode drops which remain fairly constant. This means that the ionized metal 
vapor path (the positive column which is visible in any arc) manifests a relatively small voltage drop 
and is almost constant in magnitude as the arc progresses. The characteristic voltage drop is gener- 
ally in the order of 10 to 20 volts. The arc will die only when the path length is sufficiently long 
and the resistance sufficiently high that the current falls below a required threshold. Every material 
has its own minimum arc voltage and current for given arc gap lengths and ambient pressure. These 
minimum conditions must be exceeded in order to initiate and sustain an arc. The normal voltages 
and currents within the Seasat slip rings both exceed these minimums. 

Some important characteristics of this arcing mechanism related to sets of adjacent slip ring bmsh 
assemblies are identified as follows; 

a. The arc will not occur if separation of the particle occurs at the anode first. 

b. The arc may be initiated by a small particle because it must only conduct the threshold 
current. 
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The initial series of tests were conducted by placing simulated contaminants of silver 0.006 to 
0.009 inch square and 0.125 inch long across the two fixture leads and then closing a circuit switch 
to place a nominal 30 volts between them. Peak currents less than 8 amps ejected the particles off 
the simulated brush springs with no damage to the particle, and caused only superficial pot-marking 
to the simulated brush springs. The voltage drop acnoss the fault was negligible. 

The second series of tests was conducted in vacuum on the same apparatus with a nominal 30 
VDC impressed across the simulated slip ring brush springs before the contaminant was made to 
cause a short between them. In these tests, the contaminant was introduced across the simulated 
brush springs in such a way that the particle would be ejected by the resulting short circuit cathode 
side first. In each of the four tests, the shorting particle was ejected without being damaged, and a 
severe arc was initiated. The arc characteristics were recorded on high speed strip charts, and the 
observed arc characteristics matched the arcing theory very closely. In every case severe damage was 
caused to the anode of the simulated slip ring brush spring. 

Figure 8-9 is a summary of the results of the arcing tests with the Seasat flight data included for 
comparison. The arc initiation tests that were carried on with materials, clearances, and voltage 
levels similar to those of Seasat, produced test data that closely matched the Seasat flight data. 
These data provide strong support to the conclusion that the initial fault was an arcing short be- 
tween adjacent slip ring brush assemblies of opposite polarity in the slip ring assembly. 

While the failure mode which triggered the arc in the Sperry study was a relatively long debris 
particle, it was felt by the Board that other failure modes within the slip ring assembly could also 
provide the trigger. The mechanism of arc initiation requires high thermal and voltage gradients 
together with high local temperature sufficient to produce thermionic emission. Such high gradients 
together with a high rate of local heating may be caused when one or more sharp irregularities on 
surfaces at different voltages come in contact. This is possible if either a wire carrying current of 
sufficient DC voltage makes contact with a sharp edge on a brush spring assembly at a lower voltage 
or if adjacent brush spring assemblies having sharp edges or points make contact. Therefore, a short 
caused by any of the previously described failiue modes which precipitated a sustained arc must be 
considered a prime possibility for the initial failure event. 

Sequential Propagation 

Included in the Sperry investigations were 4,000 frames per second films of the arcing as- it 
progressed. One of these films taken of test no. 3 in the test summary. Figure 8-9, was viewed by the 
Board. The onset of the arc could clearly be seen and two important characteristics were observed. 
First, the arc progressed with explosive violence. Shortly after the initiation of the arc by a 0.01 1 
inch square X 0.1 25 inch long silver rich simulated contaminant, relatively large particles of molten 
material were seen being violently ejected from the arc area. This molten material, confirmed later 
to be beryllium copper that was being melted due to the high local heating, was being ejected and 
deposited within the test chamber. A second phenomenon that was observed was the fact that as 
the arc continued, the film got progressively darker. This phenomenon was later found to be due to 
vapor deposition of the beryllium copper lead material on the view port of the vacuum test cham- 
ber. Both of the observed phenomena would contribute to the propagation of shorts within the slip 
ring assembly. The placing of opposite polarities on adjacent brushes enhances the possibiUty of 
progressive shorts due to vapor deposition of conductive material or by the deposition of the molten 
material being ejected by the arc. It can be concluded that an arcing short in the slip rings would 
probably progress along the assembly until a propagation barrier was reached. 
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The violent progress of the arc would not only propagate additional short circuits but would 
cause additional abnormal behavior of the spacecraft circuits in the wcinity of the arc. The vaporiza- 
tion of the initial arc anode could easily account for the short-term ramp rise in structure current 
shown in Figure 8-2. Vapor deposition of the conductive anode material could reasonably produce a 
circuit path to structure that would be quickly destroyed by the resulting short circuit current heat- 
ing this thin conductive deposition path to its melting point. 

High temperature would also be produced in the vicinity of the propagating shorts, resulting in 
softening or melting of the wire insulation which could cause abnormal indications if the wires 
shorted. The abnormal solar array temperature indications could be caused by the -Y solar array 
thermistor lead being shorted to a potential greater than its full scale output of 5.1 VDC which 
would then produce the high off-scale reading observed in the flight data. If this shorted voltage 
were 10 to 14 VDC, the +Y solar array temperature would also be affected through the conunon 
solar array temperature signal conditioning in the SADE that would produce the steady state -M-0°F 
offset observed in the flight data. Thus the high temperature and destructive nature of the propa- 
gating arc can account fojr all of the abnormal behavior observed in the UKO flight data. 

Flight data acquired during the AKO and ORR passes were examined thoroughly. None of the 
data were inconsistent with a short within the -Y slip ring assembly that was initially progressive 
and massive in natiure and finally reached a steady state condition. There were no data that indi- 
cated any abnormal behavior within the MPCDU and both Current Charge Controllers operated as 
designed by opening their respective K1 and K2 relays in response to the high battery temperatures. 

The activity of the CCC’s K1 and K2 relays helped identify the region of the slip ring where the 
short most likely occurred. As covered in Chapter V, the K1 and K2 relays disconnect certain solar 
array panels from the battery bus when open. In the -Y array, 1K2 controls panels 4 and 5, while 
2K2 controls panels 6, 7, and 8. At the time of the initial failure event, 2K2 was open; thus, the cir- 
cuits to panels 6, 7, and 8 could not have been involved in the initial fault. This relay closed very 
shortly after the initial fault and remained closed until the AGO pass. 

During the AGO pass, 1K2 opened, disconnecting array panels 4 and 5 with no effect on any 
voltages or currents, indicating that the circuits to these array panels were not involved in the 
“final” short. When 2K2 opened, however, a reduction in fault current of 5 to 10 amps occurred. 
Thus, a part of the steady state short clearly involved the circuits to panels 6, 7, and 8, which had 
not been connected at the time of the initial fault. At LOS at AGO, a major short still existed with 
the possibility that the circuits to panels 1, 2, 3, 9, 10, and 1 1 might be involved. 

Brush assembly connections within the slip ring assembly were such that the circuits for -Y array 
panels 8 through 1 1 were grouped on adjacent brush assemblies no. 1 through 1 1 . The circuits for 
panels 1, 2, and 3 were for the most part at the other end of the slip ring assembly and were not 
on adjacent brush assembly pairs. Thus an initial arcing short between any adjacent brush assem- 
blies 1 through 8, which connected panels 9, 10, 11, and the return of panel 8 is possible, and sub- 
sequent propagation to other brush assemblies is quite reasonable,- and is the most probable place 
for the failure to have occurred. It is noted that brushes 12 and 13 were not- connected and could, 
therefore, serve as a barrier to further fault propagation. 

Summary of Failure Mode Identification 

In summary, the Seasat flight failure occurred in the slip ring assembly of the -Y array. The initial 
fault was probably an arcing short between adjacent components within the slip ring assembly 
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initiated either by a contaminant, by physical contact of adjacent brush and rinjg assembhes, or by a 
wire-to-brush assembly short. The explosive and destructive nature of the arc caused propagation 
along the slip rings adjacent to the initial fault. 

The initial fault would have occurred between any two adjacent brush and ring assemblies of 
opposite polarity in the region of brush assemblies 1 through 1 1. The application of the slip ring 
assembly with plus power and negative return power being carried essentially on every alternate ring 
not only created a high potential for the failure mode that occurred, but also allowed the fault to 
progress along adjacent brush assemblies and rings until it reached a barrier such as unused brush 
assemblies. All other spacecraft systems functioned normally as long as adequate voltage levels were 
maintained. 
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84. Slip Ring Assembly - Brushes 1-15 (Side Cover Removed for Viewing) 
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Figure 8-5. Simulation Fixture for Debris Tests 










Figure 8-6. Shorting Particle Ejection 


8-15 





A. INITIAL 




8-16 




ARC VOLTAGE 



Figure 8-8. Voltage Within Cathode - Anode Arc 
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Figure 8-9. Sustained Arc Data in Vacuum Nominal 30 Volts-DC System 
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IX -SIGmFICANT FINDINGS 


1. The spacecraft failure that occurred on October 9, 1978, was due to a loss of electrical power 
in the Agena bus as a result of a massive and progressive electrical short withiii the slip ring assembly 
of the -Y solar array. 

2. The electrical short was most probably initiated by an arc between adjacent components 
in the slip ring assembly. Possible triggering mechanisms for this arc are momentary shorts caused 
by wire-to-brush assembly contact, brush-to-brush contact, or by a contaminant. 

3. The congested nature of the slip ring design, coupled with a wiring arrangement for con- 
necting the slip rings into the power subsystem that resulted in most of the adj'acent brush 
assemblies being of opposite polarity, made the Seasat slip ring assembly particularly prone to 
shorting. 

4. The combination of design and wiring sequence used for the Seasat slip ring assemblies made 
these units unique, first-of-a-kind components, 

5. The possibility of slip ring failures resulting from placing opposite electrical polarities on 
adjacent brush assemblies was known at least as early as the summer of 1977 to other projects 
within the prime contractor’s organization. That the Seasat organization was not fully aware of 
these potential failtire modes was due to a breakdown in communications within the contractor’s 
organization. 

6. The failure to recognize the potential failure modes of the slip ring assembly and to give this 
critical component the attention it deserved was due, in large part, to the underlying program policy 
and pervasive view that it was an existing component of a well-proven and extensively used standard 
Agena bus. This program policy further led to a concentration by project management on the 
sensors and sensor module of the spacecraft to the near exclusion of the bus subsystems. In actu- 
ality, many of these subsystems, including the power subsystem, contained components that were 
neither flight proven nor truly qualified by similarity. 

7. Lack of proper attention by both LMSC and JPL Seasat program engineering to the new 
and unproven components on the Agena bus resulted in several instances of both noncompliance 
with contractual, qualification and acceptance requirements and failure to document such non- 
compliances. 

8. The Failure Modes, Effects, and Criticality Analysis that was conducted for the electrical 
power subsystem did not consider shorts as a failure mode and thus did not reveal the presence of 
single point failure modes in the subsystem nor provide a basis for the development of a full com- 
plement of safing .command sequences that could be used by the flight controllers ir responding to 
anomalies. 
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9. The strong desire on the part of all concerned to initiate the project as soon as possible re- 
sulted in inadequate time for an effective Phase B study. As a result, the project office did not have 
the opportunity to thoughtfully plan the activity and establish the preliminary designs, component 
evaluations, test plans, and other Phase B project plans before becoming engaged in the actual space- 
craft development. 

Although umelated to the failure of the Seasat, certain deficiencies in flight control procedures 
were present that are worthy of note as a lesson for the future. The flight controllers were not 
provided with an adequate set of safing command sequences to use in response to anomalies, were 
not sufficiently familiar with the system they were controlling, received insufficient anomaly 
training and, during the failure event itself, failed to follow the prescribed procedures in response to 
the flight data available to them. Compounding these difficulties were the frequent breakdowns of 
the ground data acquisition and processing system throughout the mission. 
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X - CONCLUDING OBSERVATIONS 


It is ironic, and yet typical, of spacecraft failures that the termination of the Seasat flight was 
caused not by a malfunction of a new or sophisticated device, but by a failure in a very common 
component of a type that has flown in many spacecraft for many years. It is also ironic, and in- 
structive, that the smallest of events or the slightest of communications could have prevented the 
failure. Better clarity in an oral communication, a brief memorandum of the right kind at the ri^t 
time, a failiue report coming to the right person, or an alert engineer could have made all the dif- 
ference. 

Basic to the Seasat mission was the concept of using an existing, flight-proven spacecraft bus for 
the services and housekeeping functions required by the sensors in order to minimize program costs 
and to permit a concentration of effort on the sensors and their integration into the spacecraft. 
Thus the use of a “standard Agena bus” as part of the Seasat spacecraft became an enduring tenet 
of the program. So firmly rooted was this principle in program philosophy that, even after the 
engineering staffs of both the Government and the contractor were well aware of the final unique- 
ness of their Agena bus, the words, and the associated way of doing business, persisted. They 
became deceived by their own words. 

Consistent with the concept of the “standard Agena bus” was the policy decision to minimize 
testing and documentation, to qualify components by similarity wherever possible and to minimize 
the penetration into the Agena bus by the Government. As a result, a test was waived without 
proper approval, important component failures were not reported to project management, compli- 
ance with specifications was weak, and flight controllers were inadequately prepared for their task. 
Significantly, the Seasat slip ring assembly had no applicable flight history at the time of its launch 
and, in its application to the spacecraft, was a new device. 

There can, of course, be no quarrel with the policy of using existing and well proven equipment. 
The use of such equipment has certainly reduced the costs and contributed to the success of many 
space missions. But the world of space flight is an unforgiving one and words like “standard,” 
“existing,” and “similar to” can be traps for the unwary. The technical risks of using “standard 
equipment” can be as high as those present in a new or untried piece of equipment, but the ap- 
proach, both technical and managerial, must be different. For new equipment, one designs carefully, 
reviews thoroughly, and tests completely— and that we know how to do. For “standard” equip- 
ment, one should diligently and thoroughly probe the heritage that justifies the classification and 
identify, component by component and piece by piece, those that are truly “standard” and those 
that are not. One should assume that each space vehicle is unique until proven otherwise. Then, for 
those parts that are standard or well proven, and that are applied in the same way, one can forego 
design reviews, testing and extensive documentation. Conversely, components that are different 
should be treated as new. The policy of limited penetration into Seasat’s Agena bus by the Govern- 
ment was appropriate, but a limited penetration must be a selective penetration and not a reduced 
effort everywhere. 
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This identification of the heritage of previously used equipment, in both design and application, 
need not require a large staff or a lot of money. But it does take time, both at the start of the 
project and at the time of the Critical Design Review. And here, responding to strong desires by all 
concerned to get the project on contract and underway, the Seasat Project was denied the advantage 
of an effective Phase B study. Had there been an effective Phase B study period, preliminary designs 
would have been completed, component selections better understood, test plans and qualification 
requirements better established, and possibly, the critical role and inherent complexities of the slip 
ring assembly might have been more apparent to the Seasat engineeiing staffs. Whether such a Phase 
B study period would have precluded the Seasat failure is, of course, uncertain for history does not 
reveal its alternatives. But such a carefully conducted plaiming and study period would have mini- 
mized the chances for the type of failure that did occur. 

The policy of using existing, flight-proven equipment can be both valid and cost effective. But it 
is the main lesson of Seasat that an uncritical acceptance of such classifications as “standard” can 
submerge important differences from previously used equipment in both design and in application. 
It is important, therefore, that thorough planning be conducted at the start of a project to fully 
evaluate the heritage of such equipment, to identify those that are standard and those that are not, 
and to establish project plans and procedures that enable the system to be penetrated in a selective 
manner. 
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APPENDIX A 


• CHARTER OF SEASAT MISSION FAILURE INVESTIGATION BOARD 

• LETTER OF AUTHORIZATION TO THE BOARD CHAIRMAN 

• MEMBERSHIP OF THE BOARD 



IWNSA Notice 

Nalonal 

Aejcnautics arxj 
Admimslraion 


NN 

Date October 16, 19 78 


Responsible Office; E/Office of Space and Terrestrial Applications 
Subject: seasat mission failure investigation board 


1. PURPOSE 

This Notice establishes the Seasat Mission Failure Investigation 

Board and sets forth its responsibilities and membership. 

2. ESTABLISHMENT . 

a. The Seasat Mission Failure Investigation Board is hereby 
established because it is in the public interest to 
determine the actual or probable cause (s) of the Seasat 
mission failure. 

b. The Board is a "project-oriented technical team" as defined 
in paragraph 4d of NMI 1150. IB. 

c. The Chairman of the Board will report to the Deputy 
Administrator. 

3. AUTHORITIES AND RESPONSIBILITIES 

\ 

a. The Board will; 

(1) Determine the actual or probable cause (s) of the 
Seasat mission failure and will document the technical 
and management history of such cause or causes. 

(2) Provide a final written report to the Deputy 
Administrator . 

(3) Carry out any other responsibilities that may be 
requested by the Deputy Administrator.—. 

b. The Board may: 

(1) Obtain and analyze whatever evidence, facts, and 
opinions it considers relevant, using reports of 
studies, findings, recommendations, and other actions 
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by NASA officials and contractors and by con- 
ducting inquiries, hearings, tests/ and other 
actions de noyo— in doing so, it may take 
testimony and receive statements from witnesses. 

(2) Impound property, equipment and records to the 
extent that it considers necessary. 

c. The Chairman will: 

(1) Conduct Board activities in accordance with the 
provisions of this Notice and ciny other instruc- 
tions that the Deputy Administrator may issue. 

(2) Establish 2 Uid document, to the extent considered 
necessary, rules and procedures for the organiza- 
tion and operation of the Board, including any 
svibgroups, and for the format and content of oral 
or written reports to the Board and by it. 

(3) Designate any representatives, consultants, 
experts, liaison officers, or other individuals 
who may be required to support the activities of 
the Board and define their duties and responsi- 
bilities . 

(4) Establish and announce a target data for submit- 
ting a final report and keep the Deputy Administrator 
informed of the Board's plans, progress, and find- 
ings . All public release of information on ongoing 
Board activities will be made by the Deputy 
Administrator or, with his approval, by the 
Chairman of the Board. 

(5) Designate another member of the Board to act as 
Chairman in his absence. 

4. MEMBERSHIP 


The Chairman, members of the Board, observers and supporting 
staff are designated in Attachment A. 

5. MEETINGS 


The Chairman will arrange for the conduct of all meetings 
and for such records or minutes of meetings as he considers 
necessary. 
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6. ADMINISTRATIVE AND OTHER SUPPORT 

a. The Board will operate ^rojn NASA Headquarters, 
Washington, DC. The Director of the Jet Propulsion 
Laboratory will arrange for providing office space and 
other facilities and services that may be requested by 
the Chairman or his designee. Support will also be 
provided by the Director of the Goddard Space Flight 
Center as requested. 

b. All elements of NASA will cooperate fully with the 
Board and provide any records, data, cuid other admin- 
istrative or technical support and services that may 
be requested. The Associate Administrator for Space 
and Terrestrial Applications, will provide such funds 
as are necessary for the conduct of the Board's 
business. 

c. A specific time or milestone shall be selected after 
which all activity physically affecting the hardware 
shall cease, unless specifically directed by the Board. 

7. DURATION 

The 'Deputy Administrator will terminate the Board when it 

has fulfilled his requirements. 

8. CANCELLATION 

This Notice is automatically cancelled one year from its 

effective date. 



Deputy Administrator 


DISTRIBUTION : 

SDL 1 

Attachment : 

A - Members and Affiliates of Seasat Mission Failure 
Investigation Board. 
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National Aeronautics and 
Space Administration 

Washington, D.C. 

20546 

Office of the Administrator qqj 1 ' ■ '1073 


Dr. Bruce T. Lundin 
5859 Columbia Road 
North Olmsted, OH 44070 


Dear Bruce: 

I appreciate very much your willingness to accept the 
Chairmanship of the Seasat Mission Failure Investigation 
Board. As we discussed during our meetings last Tuesday, 
it is important -that the Board move as expeditiously as 
possible, consistent with a thorough analysis of the _ facts, 
to determine the actual or probable causes of this mission 
failure. All necessary steps are being taken to ensure 
that appropriate Agency resources and all background 
information are made available to your Committee. 

Enclosed is a copy of the NASA Notice formally establishing 
the Seasat Mission Failure Investigation Board which appoints 
you Chairman and names the other board members . I ^ believe 
the charter of this group, as set forth in the Notice, is con- 
sistent with the discussions you and I have had. I will 
appreciate your keeping me directly informed of the Committee's 
progress and of any problems you may encounter in pursuing 
this assignment. 

Both the Administrator and I appreciate your willingness to 
respond on very short notice and accept this important assign- 
ment without regard to any personal inconvenience it may cause 
you. Your continued dedication to excellence in both space 
and aeronautics constitutes a valuable asset to this Agency. 


Sincerely, 




A. M. Lovelace 
Deputy Administrator 


Enclosure 
As Stated 
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BOARD MEMBERSHIP 


Chairman 

Bruce T. Lundin 

Members 

Parker V. Counts 

James E. Hannigan 

T. Bland Norris 

Daniel J. Shramo 

James E. Stitt 

Counsel to the Board 
Robert Kinberg 

Executive Secretary 
Dell P. Williams 

USAF Liaison 

Major James T. Maimen 

GSFC Liaison 

Merland L. Moseson 


Director, Lewis Research Center 
(Retired) 


Assistant to the Director, 

Reliability and Quality Assurance Office, 
NASA Marshall Space Flight Center 

Assistant Chief for Systems, 

Flight Control Division, 

NASA Johnson Space Center 

Director, Astrophysics Division, 

Office of Space Science 
NASA Headquarters 

Director, Space Systems and Technology, 
NASA Lewis Research Center 

Director for Electronics, 

NASA Langley Research Center 


Office of General Counsel, 
NASA Headquarters 


Acting Director, Space Systems Technology Division, 
Office of Aeronautics and Space Technology, 

NASA Headquarters 


Program Manager, Space and Missiles Systems Organization, 
U.S. Air Force 


Director of Flight Assurance, 

NASA Goddard Space Flight Ceqter 
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JPL Liaison 


Lt. General Charles H. Terhune 

Special Assistant to the Board Chairman 
Vincent L. Johnson 

Technical Consultant 

Arthur F. Obenschain 


Deputy Director, 

Jet Propulsion Laboratory 


Deputy Associate Administrator for Space Science, 

NASA Headquarters 

(Retired) 


Head, Power System Design and Analysis Section, 
NASA Goddard Space Flight Center 


A-6 



APPENDIX B 


SEASAT 

SEQUENCE OF EVENTS - MISSION OPERATIONS ROOM 
REVOLUTION 1503 



APPENDIX B 


GMT 

23:30 (DOY282) 

00:54 (DOY283) 

01:32 

01:36 

01:37 

02:18 

02:20:00 

02:28:00 

02:30:41 

02:35:13 

03:00:10 

03:05:30 

03:06:00 

03:29:43 


03:31:00 


SEASAT 

SEQUENCE OF EVENTS - MISSION OPERATIONS ROOM 
REVOLUTION 1503 

ACTIVITY/ EVENT 

Team 3 on console (7:30 p.m. local time) 

Begin Rev 1502 

Start Tape Recorder #2 Recording (SPC) 

End of SAR pass at OAK HANGER (UKO) 

Tape Recorder#! Full (ready to dump) 

AOS ORRORAL (ORR) 

All Systems Normal 

Start Tape Recorder #1 Dump (RTC) 

Complete Tape Recorder #1 Dump (RTC) 

LOS ORRORAL (ORR) 

Begin Revolution 1503 

Start Tape Recorder #1 Recording (SPC) 

Tape Recorder #2 Full (ready to dump) 

Enter Earth Shadow 

AOS SANTIAGO (AGO) 

First indication of satellite problem. Battery currents off-scale high (approxi- 
mately 51 amps). Battery voltage down to approximately 24.7 V. -Y Solar 
Array Temperature off-scale high (approximately 869°F), +Y Solar Array 
Temperature off-set 40°F, unregulated bus voltage down to approximately 
24.1 V. Other system parameters read normally. LMA informed ACMO of 
these abnormal indications. ACMO’s RF and command system displays looked 
normal. All sensor data appeared normal. Vehicle attitudes looked normal. All 
on-board command sequencing was executing properly and solar arrays track- 
ing normally. Team suspected data systems data processing quality. ACMO 
changed pass plan to forego ranging mode in order to allow commanding as 
required. 

ACMO requested POCC computer reloading. 
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GMT 


ACTIVITY/ EVENT 


03:31:37 

03:32:06 

03:33:00 

03:33:08 

03:33:40 


03:41:00 

03:42:53 


03:43 to 03:59 


03:59:09 


04:03:08 

04:06:58 


Lost live data due to reloading. 

Reloading complete, regained live data. No change in data indications. 

Team still questioned data validity. ACMO requested Santiago STDN station to 
reload real-time telemetry decom program and computer telemetry processing 
program. 

Lost live data due to reloads. 

Station reloads complete, regained live data. No change in data indications. 
Still could see no sensor problems or obvious system problems from real-time 
telemetry. 

ACMO requested that ORRORAL be scheduled upon this revolution. ACMO 
discussed with LMA the possibility of a POCC computer convert table prob- 
lem. 

Exit Earth Shadow. Battery currents back on-scale, but high. 

LOS SANTIAGO (AGO) 

No RTC’s sent during pass. Problem was not understood, and no clear-cut 
corrective action was apparent. All on-board command sequencing still execut- 
ing properly. 

Team discussed data indications and possible problems, both on-board and on 
the ground. Could not identify any on-board system failure that could cause 
data indications. A “snapshot” of the POCC computer convert tables was 
made, since problems in this area were suspected, but insufficient time existed 
for in-depth analysis. Team still felt no clear-cut actions were to be taken. 
ACMO confirmed that ORRORAL would be up for this revolution at 03:59 
GMT. 

AOS ORRORAL (ORR) 

Previous indications of problem still existed. Battery voltages were down to 
22 V. Unregulated bus current up to 34 amps. Otherwise, subsystems and 
sensors still appeared normal. Convert tables still suspect, therefore, ACMO 
requested the POCC computer be switched to backup disk pack to resolve 
processing problem. 

Lost live data due to POCC computer disk SAvitching. System would not run on 
backup disk, so ACMO requested return to original configuration. 

POCC computer backup, regained live data. Data indications of problem still 
present. Team still suspecting data problem. ACMO did not have time to 
reconfigure station and command a tape recorder playback, although it was 
planned. 
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GMT 


ACTIVITY/EVENT 


04:08:28 LOS ORRORAL (ORR) 

No RTC’s sent during pass. Problem was not understood, ACMO requested 
ORR analog tape of pass be replayed into POCC computer. No further acquisi- 
tions at any stations. 

04:09 ACMO notified CMO of problem. 

04:20 LMA notified LMSC team leader of problem. 

04:15 Bepn Rev 1504; 

04:20:00 ORR Rev 1503 playback indicates data quality good, no problem with ground 

system, and that the satellite had suffered a true electrical problem. 

04:55:00 Team declared spacecraft emergency. ACMO requested command sequences to 

remove sensor power from unregulated bus (Sequence 2) be transmitted in the 
blind (during predicted MERRITT ISLAND acquisition). 

05:10:55 Last part of safing Sequence 2 transmitted in the blind (during predicted 

QUITO acquisition). 

08: 14:20 ACMO requested “no downlink” procedure be transmitted in the blind .(during 

predicted GOLDSTONE acquisition). 

Safing Sequences 1 anci 2, plus “No Downlink” procedure, transmitted in the 
blind repeatedly, from this point on. 

03:30 ACMO requested ORR Revolution 1502 tape recorder dump “quicklook” data 

tape from IPD. 

1 1 :30 Team 2 on console (7 :30 a.m. local time). 

18:30 Team received request from LMSC to transmit RTC’s which disconnect solar 

array panels 9 and 10 from diode bus, which was added to other uplink se- 
quences transmitted in the blind. 

20:30 Received ORR Rev 1502 “quicklook” data tape from IPD, and processed 

through POCC computer. 

Mission support, with repeated acquisition attempts and safing sequence transmissions, continued 

until November 10, 1978. 
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ABBREVIATIONS AND ACRONYMS 



APPENDIX C 


ACMO 

APPRO 

AGO 

ALT 

AMA 

AOS 

APL 

CCC 

CEI 

CMG 

CMO 

CPAF 

CRT 

CSE 

CTU 

DC 

DOY 

EDT 

EM 

EPS 

ESA 

FMECA 

FPI 

GFE 

GMT 

GSFC 

IPD 

JPL 

LMA 

LMSC 

LOS 

M&O 

MCT 


ABBREVIATIONS AND ACRONYMS 

Assistant Chief of Mission Operations 
Air Force Plant Representative Office 
Santiago Tracking Station 
altimeter (Seasat sensor) 

Assistant Monitor Analyst 
acquisition of signal 
Applied Physics Laboratory 

Charge Current Controller 
Contract End Item 
control moment gyro 
Chief of Mission Operations 
cost-plus-award-fee 
cathode ray tube 
Chief Systems Engineer 
command timing unit 

direct current 
Day of the Year 

Eastern Daylight Time 
Engineering Memorandum 
electrical power subsystem 
European Space Agency 

Failure Modes, Effects, and Criticality Analysis 
fixed price incentive 

Government furnished equipment 
Greenwich Mean Time 
Goddard Space Flight Center 

Information Processing Division (at GSFC) 

Jet Propulsion Laboratory 

Lead Monitor Analyst 

Lockheed Missiles and Space Company 

loss of signal 

Maintenance and Operations 
Mission Control Team 


MOR 

MPCDU 

NASA 

NASCOM 

NCR 

ODT 

ORCH 

ORR 

ORT 

PAD 

P/N 

POCG 

POS 

POST 

PSS 

RCS 

REE 

Rev 

RF 

RFP 

RFQ 

RPM 

RTC 

S/A 

-SADE 

SAM 

SAR 

SASS 

SFOP 

SMMR 

S/N 

soc 

SPAT 

S/R 

STDN 

TSU 

UKO 

VDC 

VGP 

VIRR 

WFC 

WTR 


Mission Operalioiis Eoonr 

Main Power Control and Distribution Unit 

National Aeronautics and Space Administration 
NASA Communications 
Nonconformance Report 

Operational Demonstration Test 
Operations Requirements and Constraints Handbook 
Orroral Tracking Station 
Operational Readiness Test 

Program Approval Document 
part number 

Project Operations Control Center 
Project Operations System 
POCC Operations Support Team 
Portable Simulation System 

reaction control subsystem 
^Responsible Equipment Engineer 
Revolution 
radio frequency 
Request for Proposal 
Request for Quote 
Revolutions Per Minute 
Real Time Command 

solar array 

solar array drive electronics 
solar array module 

Synthetic Aperture Radar (Seasat sensor) 
Seasat-A'Scatlerometer System (Seasat sensor) 

Space Flight Operations Plan 

Scanning Multichannel Microwave Radiometer (Seasat sensor) 

serial number 

state-of-charge 

Satellite Performance and Analysis Team 
slip ring 

Spaceflight Tracking and Data Network 
telemetry and sensor interface unit 
Oak Hanger Tracking Station 
voIts-DC 

vehicle ground point 

Visual and Infrared Radiometer (Seasat sensor) 

Wallops Flight Center 
Western Test Range 
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